WindowsSCOPE is a memory forensics and
reverse engineering product for
Windows
Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for ser ...
used for acquiring and analyzing volatile memory.
One of its uses is in the detection and reverse engineering of
rootkits
A rootkit is a collection of software, computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence o ...
and other
malware.
WindowsSCOPE supports acquisition and analysis of Windows computers running
Windows XP
Windows XP is a major release of Microsoft's Windows NT operating system. It was released to manufacturing on August 24, 2001, and later to retail on October 25, 2001. It is a direct upgrade to its predecessors, Windows 2000 for high-end and ...
through
Windows 10
Windows 10 is a major release of Microsoft's Windows NT operating system. It is the direct successor to Windows 8.1, which was released nearly two years earlier. It was released to manufacturing on July 15, 2015, and later to retail on J ...
.
Acquisition
WindowsSCOPE supports both software-based acquisition as well as hardware-assisted methods for both locked and unlocked computers. WindowsSCOPE add-on hardware for memory acquisition uses the
PCI Express bus for direct access to system memory. Memory snapshots acquired with WindowsSCOPE are stored in a repository. Memory snapshots in the repository can be compared to track changes in the system over time.
Analysis
WindowsSCOPE shows
processes,
DLLs, and
drivers running the computer at the time of the memory snapshot as well as open
network socket
A network socket is a software structure within a network node of a computer network that serves as an endpoint for sending and receiving data across the network. The structure and properties of a socket are defined by an application programmin ...
s,
file handles, and
registry key handles. It also provides
disassembly
A disassembler is a computer program that translates machine language into assembly language—the inverse operation to that of an assembler. A disassembler differs from a decompiler, which targets a high-level language rather than an assembly l ...
and
control-flow graph
In computer science, a control-flow graph (CFG) is a representation, using graph notation, of all paths that might be traversed through a program during its execution. The control-flow graph was discovered by Frances E. Allen, who noted that ...
ing for executable code. WindowsSCOPE Live is a version of the tool that allows analysis to be performed from a mobile device.
References
{{reflist, refs=
[{{cite web, last=Klanke, first=Russ, title=Digital Forensics Links, url=http://aggressivevirusdefense.wordpress.com/2009/11/22/digital-forensics-links/, work=Aggressive Virus Defense, accessdate=10 April 2012]
[{{cite web, last=Le Masle, first=Adrien, title=Detecting the HackerDefender rootkit using WindowsSCOPE, publisher=Imperial College London, url=http://www.doc.ic.ac.uk/~al1108/website/doku.php?id=windowsscope, accessdate=10 April 2012]
[{{cite web, last=Storm, first=Darlene, title=Encrypt: Be anti-forensic friendly to protect your Android and your privacy, url=http://blogs.computerworld.com/19469/encrypt_be_anti_forensic_friendly_to_protect_your_android_and_your_privacy, work=Security Is Sexy, publisher=Computerworld, accessdate=10 April 2012]
External links
WindowsSCOPE Web Site
Computer forensics
Digital forensics software