Package: appmemdumper
IntroductionThis tool automates the research of some artifacts for forensics purpose in memory dumps based uponVolatilityfor a series of common Windows applications. It is aimed to facilitate triage while addressing multiple forensics images.It can also open multiple archive formats. In case of an archive, the tool will extract all its files to a temporary directory and then try to open each file as a memory dump (except files namedREADMEorREADME.md).System RequirementsThis framework was tested on an Ubuntu 18.04 with Python 2.7. It relies on Foremost and Volatility$sudoapt-getinstallforemost
$gitclonehttps://github.com/volatilityfoundation/volatility/tmp/vol-setup
$cd/tmp/vol-setup&&sudopythonsetup.pyinstallSetup$pipinstallappmemdumperBehind a proxy ?Do not forget to add option--proxy=http://[user]:[pwd]@[host]:[port]to your pip command.Quick StartHelp$app-mem-dumper--help
AppMemDumper2.4.3
Author:AlexandreD'HondtCopyright: © 2020 A. D'Hondt
License:GNUAfferoGeneralPublicLicensev3.0

ThistoolautomatestheresearchofsomeartifactsforforensicspurposeinmemorydumpsbaseduponVolatilityfora
seriesofcommonWindowsapplications.

Itcanalsoopenmultiplearchiveformats(itusespyunpack).Incaseofanarchive,thetoolwillextractallitsfiles
toatemporarydirectoryandthentrytoopeneachfileasamemorydump.

usage:./app-mem-dumper[-aAPPS][-sSYST][-f][-pPLUGINS][--profilePROFILE][-dDUMP_DIR][-tTEMP_DIR][-u][-h][--help][-v]dump

positionalarguments:dumpmemorydumpfilepath


application/systemdumpers:-aAPPScomma-separatedlistofintegersdesignatingapplicationstobeparsedCurrentlysupported:[0]AdobeReader[8]Notepad[1]Chrome[9]OpenOffice[2]Firefox[10]PDFLite[3]FoxitReader[11]SumatraPDF[4]InternetExplorer[12]Thunderbird[5]KeePass[13]TrueCrypt[6]MSPaint[14]Wordpad[7]MediaPlayerClassic(default:all)-sSYSTcomma-separatedlistofintegersdesignatingsystemitemstobeparsedCurrentlysupported:[0]Autoruns[9]Malfind[1]Clipboard[10]Mimikatz[2]CommandLines[11]NetworkConnections[3]CriticalProcessesInfo[12]ProcessesInfo[4]Devices[13]Registry[5]DumpInfo[14]Timeline[6]FilesList[15]UserActivities[7]Kernel[16]UserHashes[8]LsaSecrets(default:none)volatilityoptions:-f,--forceforceprofilesearch,donotusecachedprofile(default:False)-pPLUGINS,--plugins-dirPLUGINSpathtocustomplugins(default:None)--profilePROFILEforceVolatilityprofile(default:None)NB:hastheprecedenceon-f/--force

outputoptions:-dDUMP_DIR,--dump-dirDUMP_DIRdumpdirectory(default:files)-tTEMP_DIR,--temp-dirTEMP_DIRtemporarydirectoryfordecompressedimages(default:.temp)-u,--updateupdatepreviousdumpdirectories(default:False)extraarguments:-hshowusagemessageandexit--helpshowthishelpmessageandexit-v,--verboseverbosemode(default:False)Usageexamples:./app-mem-dumpermemory.dmp./app-mem-dumpermy-dumps.tar.gz./app-mem-dumperdumps.zip-anone-sall./app-mem-dumperdump.raw-a1,2,4-f./app-mem-dumperdump.mem-a0,3,10,11-s0./app-mem-dumperdump.raw-v--profileWin7SP1x86Example of output$app-mem-dumpermemory.dump-v-pplugins[appmemdumper]XX:XX:XX[DEBUG]Attemptingtodecompress'memory.dump'...[appmemdumper]XX:XX:XX[DEBUG]Notanarchive,continuing...[appmemdumper]XX:XX:XX[DEBUG]Settingoutputdirectoryto'files/memory.dump'...[appmemdumper]XX:XX:XX[INFO]Openingdumpfile'memory.dump'...[appmemdumper]XX:XX:XX[INFO]Gettingprofile...[appmemdumper]XX:XX:XX[INFO]Gettingprocesses...[appmemdumper]XX:XX:XX[DEBUG]>Executingcommand'pslist'...[appmemdumper]XX:XX:XX[DEBUG]Found:mspaint.exe[appmemdumper]XX:XX:XX[DEBUG]Nothandled:audiodg.exe,csrss.exe,dllhost.exe,[...][appmemdumper]XX:XX:XX[DEBUG]Profile:Win7SP0x86[appmemdumper]XX:XX:XX[INFO]Processingdumper'dumpinfo'...[appmemdumper]XX:XX:XX[INFO]Processingdumper'mspaint'...[appmemdumper]XX:XX:XX[DEBUG]DumpingforPIDXXXX[appmemdumper]XX:XX:XX[DEBUG]>Callingcommand'memdump'...[appmemdumper]XX:XX:XX[DEBUG]>>volatility--plugins=/path/to/plugins--file=[...][appmemdumper]XX:XX:XX[INFO]>/path/to/files/memory.dump/mspaint-2640-memdump.data[appmemdumper]XX:XX:XX[WARNING]Thefollowingappliestocollectedobjectsof:
-mspaint

Rawdata(.datafiles)requiresmanualhandling;Followthisprocedure:1.OpenthecollectedresourceswithGimp2.Setthewidthandheighttotheexpectedscreenresolution3.Setanothercolorpalettethan'RVB'Restartthisprocedurebysettingotherparametersforwidth|height|palette.