Memory forensics

This article includes a list of references, related reading or external links, but its sources remain unclear because it lacks inline citations. Please help to improve this article by introducing more precise citations. (May 2023) (Learn how and when to remove this template message)

|

Memory forensics is forensic analysis of a computer's memory dump. Its primary application is investigation of advanced cyberattacks which are stealthy enough to avoid leaving data on the computer's hard drive. Consequently, the memory (e.g. RAM) must be analyzed for forensic information.

## Contents

* 1 History
* 1.1 Zeroth generation tools
* 1.2 First generation tools
* 1.3 Second generation tools
* 1.4 Third generation tools
* 2 See also
* 3 References
* 4 External links

## History

### Zeroth generation tools

Until the early 2000s, memory forensics was done on an ad hoc basis (termed unstructured analysis), often using generic data analysis tools like strings and grep.[1] These tools are not specifically created for memory forensics, and therefore are difficult to use.They also provide limited information. In general, their primary usage is to extract text from the memory dump.[2]

### First generation tools

One significant step towards structured analysis was in a February 2004 article in SysAdmin Magazine, where Michael Ford demonstrated a more rigorous practice of memory forensics.[3] In that article, he analyzes a memory based rootkit utilizing the existing Linux crash utility as well as two tools developed specifically to recover and analyze the memory forensically, memget and mempeek. In 2005, DFRWS issued a Memory Analysis Forensics Challenge.[4] In response to this challenge, more tools in this generation, specifically designed to analyze memory dumps, were created - such as MoonSols, KntTools, the FATKit, VolaTools, and Volatility.[1] These tools had knowledge of the operating system's internal data structures, and were thus capable of reconstructing the operating system's process list and process information.[4]

Although intended as research tools, they proved that operating system level memory forensics is possible and practical.[1]

### Second generation tools

Subsequently, several memory forensics tools were developed intended for practical use. These include both commercial tools like Responder PRO, Memoryze, winen, Belkasoft Live RAM Capturer, etc.. New features have been added, such as analysis of Linux and Mac OS X memory dumps, and substantial academic research has been carried out.[5][6]

Unlike Microsoft Windows, Mac OS X interest is relatively new and had only been initiated by Matthieu Suiche[7] in 2010 during Black Hat Briefings security conference. Currently, memory forensics is a standard component of incident response.[1]

### Third generation tools

Beginning 2010, more utilities focused on the visualization aspect of memory analysis, such as MoonSols LiveCloudKd presented[8][citation needed] by Matthieu Suiche at Microsoft BlueHat Security Briefings that inspired[9] a new feature in Microsoft LiveKd written by Mark Russinovich[10] to allow virtual machines introspection by accessing the memory of guest virtual machine from the host virtual machine in order to either analyze them directly with the assistance of Microsoft WinDbg or to acquire a memory dump in a Microsoft crash dump file format.

## See also

* Computer forensics
* Data breach
* Data erasure
* Data loss
* Data recovery
* Data remanence
* Data sanitization
* Digital forensics
* File carving

## References

1. ↑ 1.0 1.1 1.2 1.3 Case, Andrew; Richard III, Golden G. (March 2017). "Memory forensics: The path forward". Digital Forensics 20: 23-33. doi:10.1016/j.diin.2016.12.004.
2. ↑ Dan Farmer; Wietse Venema. "Chapter 8: Beyond Processes". Forensic Discovery. http://www.porcupine.org/forensics/forensic-discovery/chapter8.html.
3. ↑ Ford, Michael (2004). "Linux Memory Forensics". SysAdmin Magazine. http://www.drdobbs.com/linux-memory-forensics/199101801.
4. ↑ 4.0 4.1 "DFRWS 2005 Forensics Challenge". http://www.dfrws.org/2005/challenge/.
5. ↑ Petroni, N. L.; Walters, A.; Fraser, T.; Arbaugh, W. A. (2006). "FATKit: A framework for the extraction and analysis of digital forensic data from volatile system memory". Digital Investigation 3 (4): 197-210. doi:10.1016/j.diin.2006.10.001.
6. ↑ Inoue, H.; Adelstein, F.; Joyce, R. A. (2011). "Visualization in testing a volatile memory forensic tool". Digital Investigation 8 (Supplement): S42-S51. doi:10.1016/j.diin.2011.05.006.
7. ↑ Matthieu Suiche (February 2010). "Advanced Mac OS X Physical Memory Analysis". DC: Black Hat Briefings. https://www.blackhat.com/presentations/bh-dc-10/Suiche_Matthieu/Blackhat-DC-2010-Advanced-Mac-OS-X-Physical-Memory-Analysis-slides.pdf.
8. ↑ Matthieu Suiche (Fall 2010). "BlueHat Security Briefings: Fall 2010 Sessions". Microsoft Blue Hat Hacker Conference. https://technet.microsoft.com/en-us/security/ff967505.aspx.
9. ↑ Mark Russinovich. "LiveKd for Virtual Machines Debugging". http://blogs.technet.com/b/markrussinovich/archive/2010/10/14/3360991.aspx.
10. ↑ "LiveKd v5.63". 23 Mar 2021. https://technet.microsoft.com/en-us/sysinternals/livekd.aspx.

## External links

* The History of Memory Forensics & The Volatility Framework

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Memory forensics. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Memory_forensics&oldid=3983240"