Mac OS X Physical Memory Analysis

Matthieu Suiche recently gave a presentation at JSSI (Paris, France) and CanSecWest (Vancouver, Canada) about Advanced Mac OS X Physical Memory Analysis.

Technical details and slides can be found here.

This presentation explains why physical memory acquisition is important, and what (and how) kind of information can be extracted from a physical memory snapshot.