Andrew Case is the Director of Research at Volexity LLC, and a member of the Board of Directors for the Volatility Foundation. Prior to joining Volexity, he held positions as a senior incident response handler and malware analyst at Terremark Worldwide and Verizon Enterprise Solutions, where he frequently led large-scale investigations. Andrew’s previous experience also includes penetration tests, source code audits, and binary analysis. Andrew is the co-developer of Registry Decoder, a National Institute of Justice funded forensics application, as well as a core developer on the Volatility memory analysis framework. Andrew is also a co-author of the award winning book “The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory”. He has delivered private and public trainings in the fields of digital forensics and incident response to organizations around the world. Andrew’s primary research focus is physical memory analysis and he has published a number of peer-reviewed papers in the field. He has presented his research at conferences including Black Hat, RSA, SecTor, SOURCE, BSides, OMFW, GFirst, and DFRWS.
Appearing at: