Andrew Case
Andrew Case
University of New Orleans, Volexity, Volatility Foundation
Verified email at dfir.org - Homepage
Title
Cited by
Cited by
Year
The art of memory forensics: detecting malware and threats in windows, linux, and Mac memory
MH Ligh, A Case, J Levy, A Walters
John Wiley & Sons, 2014
2812014
The art of memory forensics
MH Ligh, A Case, J Levy, A Walters
Indianapolis, ID: Wiley, 2014
281*2014
Acquisition and analysis of volatile memory from android devices
J Sylve, A Case, L Marziale, GG Richard
Digital Investigation 8 (3), 175-184, 2012
1752012
FACE: automated digital evidence discovery and correlation. Digit. Investig. 5
A Case, A Cristina, L Marziale, GG Richard, V Roussev
S65–S75, 2008
157*2008
FACE: Automated digital evidence discovery and correlation
A Case, A Cristina, L Marziale, GG Richard, V Roussev
digital investigation 5, S65-S75, 2008
1512008
Memory forensics: The path forward
A Case, GG Richard
Digital Investigation 20, 23-33, 2017
632017
Dynamic recreation of kernel data structures for live forensics
A Case, L Marziale, GG Richard
Digital Investigation 7, S32-S40, 2010
452010
In lieu of swap: Analyzing compressed RAM in Mac OS X and Linux
GG Richard, A Case
Digital Investigation 11, S3-S12, 2014
272014
Detecting objective-C malware through memory forensics
A Case, GG Richard
Digital Investigation 18, S3-S10, 2016
252016
Advancing Mac OS X rootkit detection
A Case, GG Richard
Digital Investigation 14, S25-S33, 2015
192015
Treasure and tragedy in kmem_cache mining for live forensics investigation
A Case, L Marziale, C Neckar, GG Richard
digital investigation 7, S41-S47, 2010
192010
Memory analysis of the dalvik (android) virtual machine
A Case
Retrieved from, 2011
132011
Gaslight: A comprehensive fuzzing architecture for memory forensics frameworks
A Case, AK Das, SJ Park, JR Ramanujam, GG Richard
Digital Investigation 22, S86-S93, 2017
82017
De-anonymizing live CDs through physical memory analysis
A Case
Blackhat DC Security Conference, Washington DC, 2011
32011
The system can't perform the operation now. Try again later.
Articles 1–14