Andrew Case

Andrew Case is the Director of Research at Volexity and has significant experience in incident response handling and malware analysis. He has conducted numerous large-scale investigations that span enterprises and industries. Case is a core developer of the Volatility memory analysis framework, and a co-author of the highly popular and technical forensics analysis book "The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory."

• @attrc
• Dynamic Presentation Playlist

Presentations:

• 2024-08-09 13:00 - DEF CON 32 (2024) - Defeating EDR Evading Malware with Memory Forensics
• 2022-08-10 10:20 - Black Hat USA 2022 - New Memory Forensics Techniques to Defeat Device Monitoring Malware
• 2021-08-05 14:30 - Black Hat USA 2021 - Fixing a Memory Forensics Blind Spot: Linux Kernel Tracing
• 2019-08-07 14:00 - BSidesLV 2019 - Windows 10 DFIR Challenges
• ????-??-?? ??:?? - Black Hat USA 2011 - WORKSHOP - Investigating Live CDs using Volatility and Physical Memory Analysis

Copresenters:

• Golden Richard
  • 2024-08-09 13:00 - DEF CON 32 (2024) - Defeating EDR Evading Malware with Memory Forensics
  • 2022-08-10 10:20 - Black Hat USA 2022 - New Memory Forensics Techniques to Defeat Device Monitoring Malware
  • 2021-08-05 14:30 - Black Hat USA 2021 - Fixing a Memory Forensics Blind Spot: Linux Kernel Tracing
• Austin Sellers
  • 2024-08-09 13:00 - DEF CON 32 (2024) - Defeating EDR Evading Malware with Memory Forensics
  • 2022-08-10 10:20 - Black Hat USA 2022 - New Memory Forensics Techniques to Defeat Device Monitoring Malware
• Gustavo Moreira
  • 2024-08-09 13:00 - DEF CON 32 (2024) - Defeating EDR Evading Malware with Memory Forensics
  • 2022-08-10 10:20 - Black Hat USA 2022 - New Memory Forensics Techniques to Defeat Device Monitoring Malware
• David McDonald
  • 2024-08-09 13:00 - DEF CON 32 (2024) - Defeating EDR Evading Malware with Memory Forensics