Amazon AWS EC2 Forensic Memory Acquisition - LiME
Channel: DFIRScience
Date: 2021-09-21

If you are already comfortable compiling LiME skip to 08:50.
EC2 Forensics can use many of the same tools and techniques as computer forensics. Usually, just with the addition of networking concepts. In this video, we conduct EC2 Forensic memory acquisition using LiME on Amazon Linux 2. We create a lime formatted memory image of an EC2 Instance running Amazon Linux 2. However, this technique can be applied to most remote Linux forensic memory acquisitions.

We are conducting a live remove memory acquisition and demonstrate how to pair LiME and Netcat (NC) to transfer an image out of a firewalled target system.

00:00 Forensic Memory Acquisition of EC2 Amazon Linux 2
00:11 Assumptions and Prep
02:30 Technical setup
02:51 Prevent changes on the target system
03:43 Get target system kernel version
05:39 Install prereqs on forensic server
06:54 Download LiME git repository
07:20 Compile LiME
08:50 SCP to copy lime and NC to the target system
10:57 Set Netcat to listen on the forensic server
11:55 Load LiME kernel object on the target system
13:48 Use Netcat to redirect the memory image data out to the forensic server
15:15 Use a second pipe to get the hash value generated by LiME
16:08 Clean up the target system
17:02 Extracting and verifying the LiME memory image
18:51 Conclusions

When using this method try to get as much information about the target system beforehand as possible. Be ready with a similar system that way you can change kernels quickly and combine a compatible version of LiME.

With any live data forensics, avoid installing software on the target system, and minimize the number of commands entered in the target system.

https://bit.ly/2Ij9Ojc - 👍 Subscribe for weekly videos

❤️ Get early access and bonus content - https://www.patreon.com/dfirscience

Links:
* https://github.com/504ensicsLabs/LiME

010001000100011001010011011000110110100101100101011011100110001101100101 
Help make DFIR tutorials
  👍 Subscribe → https://bit.ly/2Ij9Ojc
  🛒 Shop → https://swag.dfir.science
  ❤️ Patreon → https://www.patreon.com/dfirscience

🕸️ Blog → https://DFIR.Science
🤖 Code  → https://github.com/DFIRScience
🐦 Follow → https://www.twitter.com/DFIRScience
📰 DFIR Newsletter → https://bit.ly/DFIRNews
010100110111010101100010011100110110001101110010011010010110001001100101

Tools to help manage your YouTube Channel: https://www.tubebuddy.com/DFIRScience

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. Please link back to the original video. If you want to use this video for commercial purposes, please contact us first. We would love to see what you are doing and will probably allow its use.