Operation Aurora (2009) — Memory Forensics with Volatility

Google and US companies were hit by APTs from China. Attackers used custom rootkits to hide processes in kernel memory. Volatility analysis found injected DLLs.

## Background

Google and US companies were hit by APTs from China. Attackers used custom rootkits to hide processes in kernel memory. Volatility analysis found injected DLLs.

## Learning Objective
Perform memory analysis (RAM dumps) to detect rootkits, hidden processes, and decrypted passwords using Volatility.

## Scenario
You are the lead digital forensic investigator assigned to this case. Based on the real-world events described, you must analyze the available evidence, reconstruct the timeline, and produce a forensic report.

### Key Facts
- Case: Operation Aurora (2009) — Memory Forensics with Volatility
- Year: 2009
- Domain: Cyber Forensics
- Difficulty: Expert

## Evidence Available

Refer to the dataset at: https://github.com/arora200/aplly_case_db/tree/main/datasets/fss303-operation-aurora

## Investigation Questions

1. How does Volatility's pslist differ from psscan?
2. What indicators of rootkit infection were found in memory?
3. Why did the disk remain 'clean' while RAM revealed the attacker?
4. What volatility plugins would you use to detect hidden network connections?
5. How do APTs avoid detection by traditional disk-based forensics?

## Deliverables

1. Forensic Report — Document your findings, methodology, and conclusions
2. Timeline Reconstruction — Map the sequence of events
3. Evidence Log — Document all evidence collected with hash values
4. Legal Admissibility Checklist — Ensure your evidence meets evidentiary standards

## Expert Insight
If you only image the hard drive, you miss 50% of the crime. Always dump RAM first.

## Forensic Takeaway
The disk was clean, but the RAM exposed the attacker. Volatility's pslist vs psscan found 'unlinked' processes.