Get an iPad mini, ASUS ZenScreen LED Monitor, or $350 Off with OnDemand Training thru 5/19


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

When your forensic tool only tells part of the story; finding code injection using memory analysis

  • Friday, December 04, 2020 at 3:30 PM EST (2020-12-04 20:30:00 UTC)
  • Aaron Sparling

You can now attend the webcast using your mobile device!



What do you do when you know there is more to the story than what the tool is reporting back to you? This presentation will walk through a case study where the tool was pointing to signs of code injection, but only telling half the story. We will demonstrate tips and techniques the analyst can use when doing memory analysis to complete the findings, locate the injected and analyze the injected code and validate the tools output.

Speaker Bio

Aaron Sparling

Aaron Sparling is an Officer with the Portland Police Bureau in Portland Oregon where he serves in the Investigations Branch, Forensics Evidence Division, Digital Forensic Unit. Aaron has been working in Digital Forensics for the past 8 years and has served as a Task Force Officer on the United States Secret Service Electronic Crimes Task Force and the Portland FBI Cyber Crimes Task Force. Aaron currently serves as the Chairman of the Technical Advisory Council for the US Secret Service National Computer Forensics Institute (NCFI). Aaron has presented at numerous digital forensics conferences to include the MAGNET User Summit and the SANS DFIR Summit. Aaron currently holds a GIAC GREM, GIAC GFCA, GIAC GFCE, GIAC GSEC, CFCE, MCFE and Certified Blacklight Examiner. 

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.