This week we will begin with a very basic introduction into the memory analysis framework Volatility. We will use volatility to collect information about a memory image, recover the processes that were running in the system at the time of acquisition, and try to find malicious processes within the memory image. We will cover volatility in more depth in a later video.
Research | Practice
Showing posts with label Memory Forensics. Show all posts
Showing posts with label Memory Forensics. Show all posts
2016-12-19
2016-12-15
What I'm Reading: Robust bootstrapping memory analysis against anti forensics
Thursday, December 15, 2016
Posted by Unknown
anti-forensics, dfir, Digital Forensics, Digital Investigation, Memory Forensics
No comments
Today we are talking about 'Robust bootstrapping memory analysis against anti-forensics' by Lee Kyoungho, Hwang Hyunuk, Kim Kibom and Noh BongNam. This paper deals with anti-forensics techniques against memory analysis, as well as using KiInitialPCR as a more tamper-resistant data structure for OS fingerprinting and process list extraction.
K. Lee, H. Hwang, K. Kim, and B. Noh, “Robust bootstrapping memory analysis against anti-forensics,” Digit. Investig., vol. 18, Supplement, pp. S23–S32, Aug. 2016.
Science Direct: http://www.sciencedirect.com/science/article/pii/S1742287616300408
DFRWS Archive: https://www.dfrws.org/file/712/download?token=sWs0HHYB
K. Lee, H. Hwang, K. Kim, and B. Noh, “Robust bootstrapping memory analysis against anti-forensics,” Digit. Investig., vol. 18, Supplement, pp. S23–S32, Aug. 2016.
Science Direct: http://www.sciencedirect.com/science/article/pii/S1742287616300408
DFRWS Archive: https://www.dfrws.org/file/712/download?token=sWs0HHYB
2016-12-12
[How To] Digital Forensic Memory Analysis - strings, grep and photorec
Monday, December 12, 2016
Posted by Unknown
dfir, Digital Forensics, HowTo, Memory Forensics
No comments
This week we will show how to use basic data processing tools strings, grep and photorec to start an analysis of a Random Access Memory (RAM) image, even if we currently know nothing about the image. These methods are extremely basic types of analysis, but they are also fast and can produce some interesting results.
2016-12-05
[How To] Forensic Memory Acquisition in Linux - LiME
Monday, December 05, 2016
Posted by Unknown
dfir, Digital Forensics, Forensic Acquisition, HowTo, Memory Forensics
No comments
This week we will be using LiME to acquire a memory image in a suspect Linux system. LiME is a loadable kernel module that needs to be compiled based on the specific arch of the suspect device. We show the basics of compiling, and how to load the kernel object to copy a RAW memory image.
2016-11-28
[How To] Forensic Memory Acquisition in Windows - FTK Imager
Monday, November 28, 2016
Posted by Unknown
dfir, Digital Forensics, Forensic Acquisition, HowTo, Memory Forensics
No comments
This week we will show you have to do a very simple Windows Memory acquisition using AccessData's FTK Imager.
2016-07-18
[CFP] Digital Investigation: Special Issue on Volatile Memory Analysis
Digital Investigation: Special Issue on Volatile Memory Analysis
Deadline for submissions is 31 August 2016.
Memory analysis is a hot research topic with wide applications on many fronts - from malware detection and analysis, to recovery of encryption keys, to user activity reconstruction. As advanced contemporary malware increasingly reduces its on-disk footprint, and adopts increasingly sophisticated host detection subversion mechanisms, memory analysis is currently mainstreaming as a valuable technique for detection and response.
While memory analysis presents many new opportunities, it also presents new complications and challenges, ranging from reliance on undocumented program internals, to atomicity of acquisition methodologies. As memory analysis becomes the status quo methodology the use of directed anti-forensics is also becoming prevalent.
This special issue of the Journal of Digital Investigation invites original research papers that report on state-of-the-art and recent advancements in this rapidly expanding area of enquiry, with a particular emphasis on novel techniques and practical applications for the forensic and incident response community.
Topics of interest include but are not limited to:
- Malware detection in memory
- Live memory analysis
- Live system introspection
- Memory acquisition
- Memory analysis of large systems
- Userspace and application specific memory analysis
- Cryptographic analysis, key recovery
- Execution history analysis
- Data fusion between memory/disk/network
2012-06-01
Goldfish
Project: Goldfish
Purpose: MAC OS X automated memory acquisition and analysis tool
Developer(s): Pavel Gladyshev, Afrah Almansoori
More information:
Goldfish is a MAC OS X live forensic tool for use by law enforcement. Its main purpose is to provide an easy to use interface to dump system RAM of a target OS X machine via a firewire connection. It then automatically extracts the current user login password and any open AIM conversation fragments that may be available.
Related Publications:
Gladyshev, P. and A. Almansoori (2010). Reliable
Acquisition of RAM dumps from Intel-based Apple Mac computers over FireWire. Second
International Conference on Digital Forensics and Cyber Crime (ICDF2C). Abu
Dhabi, UAE, ICST.
- Publications
- Websites
2009-03-19
FireWire DMA Attacks for Memory Acquisition
Firewire exploits that can be used to dump, or even alter a target machine's RAM.
http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation
The same method is used by Goldfish to acquire RAM. For more information please see: Reliable Acquisition of RAM Dumps from Intel-Based Apple Mac Computers over FireWire
http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation
The same method is used by Goldfish to acquire RAM. For more information please see: Reliable Acquisition of RAM Dumps from Intel-Based Apple Mac Computers over FireWire