The Experts below are selected from a list of 81 Experts worldwide ranked by ideXlab platform

Steven J Luck - One of the best experts on this subject based on the ideXlab platform.

  • erplab an open source toolbox for the analysis of event related potentials
    Frontiers in Human Neuroscience, 2014
    Co-Authors: Javier Lopezcalderon, Steven J Luck
    Abstract:

    ERPLAB Toolbox is a freely available, open-source toolbox for processing and analyzing event-related potential (ERP) data in the MATLAB environment. ERPLAB is closely integrated with EEGLAB, a popular open-source toolbox that provides many EEG preprocessing steps and an excellent user interface design. ERPLAB adds to EEGLAB’s EEG processing functions, providing additional tools for filtering, artifact detection, re-referencing, and sorting of events, among others. ERPLAB also provides robust tools for averaging EEG segments together to create averaged ERPs, for creating difference waves and other recombinations of ERP waveforms through algebraic expressions, for filtering and re-referencing the averaged ERPs, for plotting ERP waveforms and scalp maps, and for quantifying several types of amplitudes and latencies. ERPLAB’s tools can be accessed either from an easy-to-learn graphical user interface or from MATLAB scripts, and a Command History function makes it easy for users with no programming experience to write scripts. Consequently, ERPLAB provides both ease of use and virtually unlimited power and flexibility, making it appropriate for the analysis of both simple and complex ERP experiments. Several forms of documentation are available, including a detailed user’s guide, a step-by-step tutorial, a scripting guide, and a set of video-based demonstrations.

Frank Block - One of the best experts on this subject based on the ideXlab platform.

  • linux memory forensics expanding rekall for userland investigation
    2018 11th International Conference on IT Security Incident Management & IT Forensics (IMF), 2018
    Co-Authors: Johannes Stadlinger, Andreas Dewald, Frank Block
    Abstract:

    The field of memory forensics is getting more important in forensic investigations for obtaining valuable data of a running system. Besides kernel artifacts, there might be also plenty of interesting data in the heap of a user space process, but unfortunately, that area has not yet received the attention it deserves in the forensic field. This paper shows that the heap of user applications may also be a rich source of information including data like credentials that can be helpful in a forensic investigation. With the help of the HeapAnalysis plugins, previously published by Block, we examined the heap of selected Linux userland software and managed to identify data of interest and also certain application-internal structures, which link those data snippets together. The result of our analysis is a set of plugins for the Rekall framework, enabling an investigator to automatically extract process-related information such as login credentials, Command History and file information for those applications.

  • linux memory forensics
    Digital Investigation, 2017
    Co-Authors: Frank Block, Andreas Dewald
    Abstract:

    The analysis of memory during a forensic investigation is often an important step to reconstruct events. While prior work in this field has mostly concentrated on information residing in the kernel space (process lists, network connections, and so on) and in particular on the Microsoft Windows operating system, this work focuses on Linux user space processes as they might also contain valuable information for an investigation. Because a lot of process data is located in the heap, this work in the first place concentrates on the analysis of Glibc's heap implementation and on how and where heap related information is stored in the virtual memory of Linux processes that use this implementation. Up to now, the heap was mostly considered a large cohesive memory region from a memory forensics perspective, making it rather hard manual work to identify relevant information inside. We introduce a Python class for the memory analysis framework Rekall that is based on our analysis results and allows access to all chunks contained in the heap and their meta information. Further, based on this class, six plugins have been developed that support an investigator in analyzing user space processes: Four of these plugins provide generic analysis capabilities such as finding information/references within chunks and dumping chunks into separate files for further investigation. These plugins have been used to reverse engineer data structures within the heap for user space processes, while illustrating how such plugins ease the whole analysis process. The remaining two plugins are a result of these user space process analyses and are extracting the Command History for the zsh shell and password entry information for the password manager KeePassX.

Javier Lopezcalderon - One of the best experts on this subject based on the ideXlab platform.

  • erplab an open source toolbox for the analysis of event related potentials
    Frontiers in Human Neuroscience, 2014
    Co-Authors: Javier Lopezcalderon, Steven J Luck
    Abstract:

    ERPLAB Toolbox is a freely available, open-source toolbox for processing and analyzing event-related potential (ERP) data in the MATLAB environment. ERPLAB is closely integrated with EEGLAB, a popular open-source toolbox that provides many EEG preprocessing steps and an excellent user interface design. ERPLAB adds to EEGLAB’s EEG processing functions, providing additional tools for filtering, artifact detection, re-referencing, and sorting of events, among others. ERPLAB also provides robust tools for averaging EEG segments together to create averaged ERPs, for creating difference waves and other recombinations of ERP waveforms through algebraic expressions, for filtering and re-referencing the averaged ERPs, for plotting ERP waveforms and scalp maps, and for quantifying several types of amplitudes and latencies. ERPLAB’s tools can be accessed either from an easy-to-learn graphical user interface or from MATLAB scripts, and a Command History function makes it easy for users with no programming experience to write scripts. Consequently, ERPLAB provides both ease of use and virtually unlimited power and flexibility, making it appropriate for the analysis of both simple and complex ERP experiments. Several forms of documentation are available, including a detailed user’s guide, a step-by-step tutorial, a scripting guide, and a set of video-based demonstrations.

Andreas Dewald - One of the best experts on this subject based on the ideXlab platform.

  • linux memory forensics expanding rekall for userland investigation
    2018 11th International Conference on IT Security Incident Management & IT Forensics (IMF), 2018
    Co-Authors: Johannes Stadlinger, Andreas Dewald, Frank Block
    Abstract:

    The field of memory forensics is getting more important in forensic investigations for obtaining valuable data of a running system. Besides kernel artifacts, there might be also plenty of interesting data in the heap of a user space process, but unfortunately, that area has not yet received the attention it deserves in the forensic field. This paper shows that the heap of user applications may also be a rich source of information including data like credentials that can be helpful in a forensic investigation. With the help of the HeapAnalysis plugins, previously published by Block, we examined the heap of selected Linux userland software and managed to identify data of interest and also certain application-internal structures, which link those data snippets together. The result of our analysis is a set of plugins for the Rekall framework, enabling an investigator to automatically extract process-related information such as login credentials, Command History and file information for those applications.

  • linux memory forensics
    Digital Investigation, 2017
    Co-Authors: Frank Block, Andreas Dewald
    Abstract:

    The analysis of memory during a forensic investigation is often an important step to reconstruct events. While prior work in this field has mostly concentrated on information residing in the kernel space (process lists, network connections, and so on) and in particular on the Microsoft Windows operating system, this work focuses on Linux user space processes as they might also contain valuable information for an investigation. Because a lot of process data is located in the heap, this work in the first place concentrates on the analysis of Glibc's heap implementation and on how and where heap related information is stored in the virtual memory of Linux processes that use this implementation. Up to now, the heap was mostly considered a large cohesive memory region from a memory forensics perspective, making it rather hard manual work to identify relevant information inside. We introduce a Python class for the memory analysis framework Rekall that is based on our analysis results and allows access to all chunks contained in the heap and their meta information. Further, based on this class, six plugins have been developed that support an investigator in analyzing user space processes: Four of these plugins provide generic analysis capabilities such as finding information/references within chunks and dumping chunks into separate files for further investigation. These plugins have been used to reverse engineer data structures within the heap for user space processes, while illustrating how such plugins ease the whole analysis process. The remaining two plugins are a result of these user space process analyses and are extracting the Command History for the zsh shell and password entry information for the password manager KeePassX.

Scott Makeig - One of the best experts on this subject based on the ideXlab platform.

  • eeglab an open source toolbox for analysis of single trial eeg dynamics including independent component analysis
    Journal of Neuroscience Methods, 2004
    Co-Authors: Arnaud Delorme, Scott Makeig
    Abstract:

    We have developed a toolbox and graphic user interface, EEGLAB, running under the cross-platform MATLAB environment (The Mathworks, Inc.) for processing collections of single-trial and/or averaged EEG data of any number of channels. Available functions include EEG data, channel and event information importing, data visualization (scrolling, scalp map and dipole model plotting, plus multi-trial ERP-image plots), preprocessing (including artifact rejection, filtering, epoch selection, and averaging), Independent Component Analysis (ICA) and time/frequency decompositions including channel and component cross-coherence supported by bootstrap statistical methods based on data resampling. EEGLAB functions are organized into three layers. Top-layer functions allow users to interact with the data through the graphic interface without needing to use MATLAB syntax. Menu options allow users to tune the behavior of EEGLAB to available memory. Middle-layer functions allow users to customize data processing using Command History and interactive 'pop' functions. Experienced MATLAB users can use EEGLAB data structures and stand-alone signal processing functions to write custom and/or batch analysis scripts. Extensive function help and tutorial information are included. A 'plug-in' facility allows easy incorporation of new EEG modules into the main menu. EEGLAB is freely available (http://www.sccn.ucsd.edu/eeglab/) under the GNU public license for noncommercial use and open source development, together with sample data, user tutorial and extensive documentation.