Category: Digital Forensics

Volatility imageinfo

Posted on by randrada

Memory Analysis using Volatility - imageinfo

Download Volatility Standalone 2.6 for Windows
Install Volatility in Linux

Volatility is a tool used for extraction of digital artifacts from volatile memory(RAM) samples. Volatility uses a set of plugins that can be used to extract these artifacts in a time efficient and quick manner.

imageinfo – a volatility plugin that is used to identify the information of an image or memory dump.

From an incident response perspective, the volatile data residing inside the system’s memory contains rich information such as passwords, credentials, network connections, malware intrusions, registry hives, and etc. that can be a valuable source of evidence and is not typically stored on the local hard disk. This is one of the investigator’s favorite data sources to perform digital forensics on, and knowing the right tool to dump memory is a must.

 

Plugins

In some cases, an investigator will perform and you won’t know the profile ahead of time.

For example, another investigator might have acquired the memory and have not documented the operating system version. the Volatility imageinfo plugin helps the analyst determine the proper profile if that happens.

Our syntax will be like: vol.exe -f <memory_dump> imageinfo

After identifying the right image version we can then feed this information to the –profile parameter

Then, Our syntax will be like: vol.exe -f <memory_dump> –profile=<OS_version> <plugin>

Volatility psxview

Posted on by randrada

Memory Analysis using Volatility - psxview

Download Volatility Standalone 2.6 for Windows
Install Volatility in Linux

Volatility is a tool used for extraction of digital artifacts from volatile memory(RAM) samples. Volatility uses a set of plugins that can be used to extract these artifacts in a time efficient and quick manner.

psxview – a volatility plugin that find hidden processes with various process listings. This plugin compares the active processes indicated within psActiveProcessHead with any other possible sources within the memory image.

This combines the output of plugins pslist and psscan. Some malware manipulates the EPROCESS structure, which is part of the stealth technique they use. A malicious sample can detach itself from the active process link which has FLINK (forward link) and BLINK (backward link) that is use by Windows EPROCESS structure to link the all processes.

From an incident response perspective, the volatile data residing inside the system’s memory contains rich information such as passwords, credentials, network connections, malware intrusions, registry hives, and etc. that can be a valuable source of evidence and is not typically stored on the local hard disk. This is one of the investigator’s favorite data sources to perform digital forensics on, and knowing the right tool to dump memory is a must.

Plugins

Using the Volatility psxview plugin, we can see if the process appears in pslist and psscan plugin by the boolean value True. A False within the column indicates that the process is not found in that area.

This allows the analyst to review the list and determine if there’s a legitimate reason for that.

Our syntax will be like: Vol.exe -f <memory_dump> –profile=<OS_version> psxview

Volatility pstree

Posted on by randrada

Memory Analysis using Volatility - pstree

Download Volatility Standalone 2.6 for Windows
Install Volatility in Linux

Volatility is a tool used for extraction of digital artifacts from volatile memory(RAM) samples. Volatility uses a set of plugins that can be used to extract these artifacts in a time efficient and quick manner.

pstree – a volatility plugin that print all running processes as a tree(parent-child relationship).

From an incident response perspective, the volatile data residing inside the system’s memory contains rich information such as passwords, credentials, network connections, malware intrusions, registry hives, and etc. that can be a valuable source of evidence and is not typically stored on the local hard disk. This is one of the investigator’s favorite data sources to perform digital forensics on, and knowing the right tool to dump memory is a must.

 

Plugins

Using the Volatility pstree plugin, we can see the parent child relationship of all the processes.

This plugin can be a good use to detect if the sample have spawned another process.

#note: We can identify the child process because it is indented from the parent process.

Our syntax will be like: Vol.exe -f <memory_dump> –profile=<OS_version> pstree

In this sample, we can see that NjRAT malware spawned another processes when infecting the system.

Volatility pslist

Posted on by randrada

Memory Analysis using Volatility - pslist

Download Volatility Standalone 2.6 for Windows
Install Volatility in Linux

Volatility is a tool used for extraction of digital artifacts from volatile memory(RAM) samples. Volatility uses a set of plugins that can be used to extract these artifacts in a time efficient and quick manner.

pslist – a volatility plugin that print all running processes by following the EPROCESS (a structure that Windows used to represent a process) lists.

From an incident response perspective, the volatile data residing inside the system’s memory contains rich information such as passwords, credentials, network connections, malware intrusions, registry hives, and etc. that can be a valuable source of evidence and is not typically stored on the local hard disk. This is one of the investigator’s favorite data sources to perform digital forensics on, and knowing the right tool to dump memory is a must.

Plugins

Volatility pslist plugin enumerates all the running processes inside the captured memory dump.

This includes the (1) Process ID, (2) Parent Process ID, (3) Session ID and etc.

Our syntax will be like: Vol.exe -f <memory_dump> –profile=<OS_Version> pslist

To filter running processes,

We can use the -p option then feed it with the Process ID of choice.

Our syntax will be like: Vol.exe -f <memory_dump> –profile=<OS> pslist -p <PID>

In this sample we can see that pslist has enumerated all running processes, including a process that has an odd name with the process ID 4040.

OSForensics

Posted on by randrada

Digital Forensics using PassMark - OSForensics

Try OSForensic Free Trial
Click here to view OSForensics use cases

OSForensics is a commercial forensic tool designed to perform automatic triage for a faster and more reliable way to locate files on a Windows computer. You can search by filename, size, creation and modified dates, and other criteria depending on your needs.

Results are returned and made available in several different useful views. This includes the Timeline View, which allows you to sift through the matches on a timeline, making evident the pattern of user activity on the machine.

OSForensics has these capabilities:

From an incident response perspective, the volatile data residing inside the system’s memory contains rich information such as passwords, credentials, network connections, malware intrusions, registry hives, and etc. that can be a valuable source of evidence and is not typically stored on the local hard disk. This is one of the investigator’s favorite data sources to perform digital forensics on, and knowing the right tool to dump memory is a must.

Related Topic

WinPmem

Posted on by randrada

Memory Acquisition using Velocidex Enterprise - WinPmem

Velocidex WinPmem Github
Download WinPmem
WinPmem Releases
Click here to view Velocidex WinPMem use cases

WinPmem is a physical memory acquisition tool allowing investigator to recover and analyze valuable artifacts that are often only found in memory.

WinPmem has its following features:

      • Open Source
      • Support for WinXP – Win10, x86, x64. The WDK7600 can be used to include WinXP support. As default, the provided WinPmem executables will be compiled with WDK10, supporting Win7 – Win10, and feature more modern code.
      • Three different independent method to create memory dump. One method should always work even when faced with kernel mode rootkits.
      • Raw memory dump image support.
      • A read device interface is used instead of writing the image from the kernel like some other imagers. This allows us to have complex userspace imager (e.g. copy across network, hash etc), as well as analysis on the live system(e.g. can be run directly on the device).

In an incident response perspective, the volatile data residing inside the system’s memory contains rich information such as passwords, credentials, network connection, malware intrusions, registry hives and etc that can be a valuable source as an evidence and not typically stored on the local hard disk. This is one of the investigator’s favorite data source to perform digital forensics and knowing the right tool to dump memory is a must.

Related Topic

Magnet RAM Capture

Posted on by randrada

Memory Acquisition using Magnet Forensics - RAM Capture

Download Magnet RAM Capture
Click here view Magnet Forensics RAM Capture use cases

Magnet RAM Captuer is a free imaging tool designed to capture the physical memory of a suspect’s computer, allowing investigators to recover and analyze valuable artifacts that are often only found in memory.

Magnet RAM Capture has a small memory footprint, meaning investigators can run the tool while minimizing the amount of data that is overwritten in memory. You can export captured memory data in Raw (.DMP/.RAW/.BIN) format and easily upload it into leading analysis tools, including Magnet AXIOM and Magnet IEF.

Why Memory Dump?

Volatile memory can reveal a lot of important information about a system and its users. There are often instances where evidence stored in memory is never written to the hard drive and may only be found in pagefile.sys and hiberfil.sys. Memory analysis is essential to many malware and intrusion incidents and can be imperative in recovering valuable evidence for almost any PC investigation. Running processes and programs, active network connections, registry hives, passwords, keys, and decrypted files are just a few examples of the evidence that can be found in memory. Many web apps, like Gmail, or private/incognito browsing modes, will only store data in memory, meaning the evidence cannot be recovered from the hard disk. (source: https://www.magnetforensics.com/blog/acquiring-memory-with-magnet-ram-capture/).

From an incident response perspective, the volatile data residing inside the system’s memory contains rich information such as passwords, credentials, network connections, malware intrusions, registry hives, and etc. that can be a valuable source of evidence and is not typically stored on the local hard disk. This is one of the investigator’s favorite data sources to perform digital forensics on, and knowing the right tool to dump memory is a must.

 

Related Topic

AccessData FTK

Posted on by randrada

Memory Acquisition using AccessData - FTK

Download FTK Imager 4.7
Click here to view FTK Imager use cases

FTK Imager is a data preview and imaging tool used to acquire data(evidence) in a forensically sound manner by creating copies of data without making changes to the original evidence. FTK Imager 4.5 includes faster image creation, additional evidence processing improvements including XFS file system support, improvements to the command line, disk imaging , evidence parsing, and memory dump.

Why Memory Dump?

Volatile memory, or RAM, is used to store data currently used by a running process: whether it is a user application or a system service. This type of memory is much quicker than a regular hard drive, but unlike files permanently stored on a drive(unless deleted), data from RAM may disappear instantly. At the time, it may store data crucial for your case, including passwords in raw format without encryption or encoding, decrypted data otherwise kept encrypted on a drive, decryption keys for various services, apps, and WDE, remote session data; chats in social networks; malware code; cryptocurrency transactions; various system info such as loaded registry branches; and so on.(source: https://belkasoft.com/ram-dumping-tool-selection)

From an incident response perspective, the volatile data residing inside the system’s memory contains rich information such as passwords, credentials, network connections, malware intrusions, registry hives, and etc. that can be a valuable source of evidence and is not typically stored on the local hard disk. This is one of the investigator’s favorite data sources to perform digital forensics on, and knowing the right tool to dump memory is a must.

Related Topic

Dumpit

Posted on by randrada

Memory Acquisition using MoonSols - DumpIt.exe

Download DumpIt.exe

DumpIt is a tiny free utility tool that is used to generate a physical memory dump of Windows machines. It works with both x86 and x64 machines. The raw memory dump is generated in the current directory; only a confirmation question is prompted before starting. This is perfect for deploying the executable on USB keys for quick incident response needs.

Why Memory Dump?

Volatile memory, or RAM, is used to store data currently used by a running
process: whether it is a user application or a system service. This type of memory is much quicker than a regular hard drive, but unlike files permanently stored on a drive(unless deleted), data from RAM may disappear instantly. At the time, it may store data crucial for your case, including passwords in raw format without encryption or encoding, decrypted data otherwise kept encrypted on a drive, decryption keys for various services, apps, and WDE, remote session data; chats in social networks; malware code; cryptocurrency transactions; various system info such as loaded registry branches; and so on.(source: https://belkasoft.com/ram-dumping-tool-selection)

From an incident response perspective, the volatile data residing inside the
system’s memory contains rich information such as passwords, credentials, network connections, malware intrusions, registry hives, and etc. that can be a valuable source of evidence and is not typically stored on the local hard disk. This is one of the investigator’s favorite data sources to perform digital forensics on, and knowing the right tool to dump memory is a must.

Related Topic

This is a GUI-based tool, which is easy to use.

After executing the DumpIt.exe tool, it will prompt with a question.

Hit “y” to proceed, then a live RAM capture will be dumped.

#note: This may take a while depending on the resources on your system you’re working on.

 

Belkasoft RamCapture

Posted on by randrada

Memory Acquisition using Belkasoft - Live RAM Capture

Download Belkasoft Live RAM Capturer
Click here to view Belkasoft RamCapture uses cases

Belkasoft Live RAM Capturer is a tiny free forensic tool that allows you to reliably extract the entire contents of a computer’s volatile memory-even if protected by anti-debugging or anti-dumping system. Belkasoft RAM Capturer is compatible with all versions and editions of Windows, including XP, Vista, Windows 7, 8, and 10, 2003, and 2008 Server.

Why Memory Dump?

Volatile memory, or RAM, is used to store data currently used by a
running process: whether it is a user application or a system service.
This type of memory is much quicker than a regular hard drive, but
unlike files permanently stored on a drive(unless deleted), data from
RAM may disappear instantly. At the time, it may store data crucial for
your case, including passwords in raw format without encryption or
encoding, decrypted data otherwise kept encrypted on a drive, decryption
keys for various services, apps, and WDE, remote session data; chats in
social networks; malware code; cryptocurrency transactions; various
system info such as loaded registry branches; and so on.(source: https://belkasoft.com/ram-dumping-tool-selection)

From an incident response perspective, the volatile data residing inside the system’s memory contains rich information such as passwords, credentials, network connections, malware intrusions, registry hives, and etc. that can be a valuable source of evidence and is not typically stored on the local hard disk. This is one of the investigator’s favorite data sources to perform digital forensics on, and knowing the right tool to dump memory is a must.

Related Topic