Episode 198: Analyzing Mac RAM in AXIOM

In this episode, we mount a RAM image from a Mac computer. Using AXIOM, we then look at some of the contents. This gives the viewer an idea of some of the items available in a Mac RAM image.

The SANS 3MinMax series with Kevin Ripa is designed around short, three-minute presentations on a variety of topics from within Digital Forensics, Incident Response, and to a lesser degree, Information Security.

About the author:
An investigator at heart, Kevin Ripa bought his first computer as a tool for writing reports for his private investigation agency. As he worked through typical user issues, the "why" of what was going wrong in his machine kept him up at night. So Kevin turned his investigative skills toward his computer and quickly became fascinated by the world inside of it. Now a 25-year veteran of the digital investigations field, Kevin's enthusiasm has not waned: "IT security and digital forensics still inspire me every day, and I can't wait to wake up in the morning and get to work!"
Kevin is a SANS Certified instructor and the co-author of the SANS course FOR498: Battlefield Forensics and Data Acquisition. For more information about the course, visit: http://www.sans.org/FOR498​

If you would like to suggest a topic for the next 3MinMax episodes, please email [email protected] or reach out to Kevin via twitter at @kevinripa (  / kevinripa​  )