Hack Like a Pro: Digital Forensics for the Aspiring Hacker, Part 14 (Live Memory Forensics) « Null Byte :: WonderHowTo

Welcome back, my budding hackers!One of the most basic skills the forensic investigator must master is the acquisition of data in a forensically sound manner. If data is not captured in a forensically sound manner, it may not be admissible in court. In myKali Forensicsseries, I showed youhow to acquire a forensically sound, bit-by-bit image of a storage devicesuch as a hard drive or flash drive, but now let's dive into live memory.Why Capture Live Memory?In some cases, the forensic investigator will need to grab an image of the live memory. Remember, RAM is volatile and once the system is turned off, any information in RAM will be lost. This information may include passwords, processes running, sockets open, clipboard contents, etc. All of this information must be captured before powering down the system or transporting it.In addition, many hard drives are encrypted with such things asTrueCryptand the password resides in RAM. If the hard drive is encrypted, then capturing volatile data is even more crucial as the hard drive information may be unavailable to the forensic investigator without it.There are many tools for capturing data from memory, but one company, AccessData, has been providing their FTK (Forensic Tool Kit) Imager for years for free and, as a result, it has become the de facto standard in image capturing. You candownload the FTK Imager here.Step 1: Using the FTK Imager to Capture MemoryOnce we have downloaded and installed FTK Imager, we should be greeted by a screen like that below.Next, click on the "File" pulldown menu and go to the "Capture Memory" selection.It will open a window like that below. You will have to select where to store your memory dump, what to call the file, whether you want to include the page file (virtual memory), and whether you want to create an AD1 file (AccessData's proprietary data type).In my case, I created a directory called "memory dumps," named the file memdump.mem, included the virtual memory or pagefile, but did not create an AD1 file. I recommend you do something similar.When you completed each of these, click the "Capture Memory" button.This will start a window that will track the progress of your capture. If the system has a lot of memory, that could take awhile.Step 2: Volatility Memory Analysis ToolAnalyzing a memory capture is a bit different from a hard drive analysis. One of the beauties of memory analysis is the ability to actually recreate what the suspect was doing at the time of the system capture.Among the most widely used tools for memory analysis is the open-source tool appropriately namedVolatility. It is built into Kali Linux, so there's no need to download it. Simply transfer the memory image you captured to your Kali machine and we can begin our analysis.If you aren't using Kali, you can download Volatilityhere. It has been ported for Window, Linux, and Mac OS X, so it will work on nearly any platform.Step 3: Using Volatility for AnalysisTo use Volatility, navigate to/usr/share/volatility.kali > cd /usr/share/volatilitySince Volatility is a python script, you will need to preface the command with the keywordpython. To view the help page, type:kali > python vol.py -hThis will display a long list a command options.And plugins.Before we can do any work on this memory image, we first need to get the profile of the image. This will retrieve key information from the image. This profile will then help volatility to determine where in the memory capture key information resides as each operating system places information in different address spaces.To get the profile, type:kali > python vol.py imageinfo -f /location of your imagefileFor instance, I put my image on my desktop, so my command would be:kali > python vol.py imageinfo -f /root/Desktop/memdump.memThis command will examine the memory file for evidence of the operating system and other key information.As you can see in the screenshot above, Volatility identified the OS as Win7SP0x64 (Windows 7, no service pack, 64-bit). It also identifies AS layer1 and 2, the number of processors, the service pack, and the physical address space for each processor, among many other things.Step 4: Using the ProfileNow that we have recovered the profile of this memory dump, we can begin to use some of the other functionality of Volatility. For instance, if we wanted to list the registry hives including SAM, we could use thehiveinfoplugin by typing:kali > python vol.py --profile Win7SP1x64 hiveinfo -f /locationof your image/Note that Volatility was able to list all of the hives including their virtual and physical location in RAM.Volatility is a powerful memory analysis tool with tens of plugins that enable us to find evidence of what the suspect was doing at the time of computer seizure. In future tutorials, I will show you more of the multitude of uses of this tool and how we can use it to find evidence of the activities of the suspect. So keep coming back, my budding hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)How To:Become a Computer Forensics Pro with This $29 TrainingHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics)News:Why YOU Should Study Digital ForensicsHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 6 (Using IDA Pro)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 11 (Using Splunk)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 15 (Parsing Out Key Info from Memory)News:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 8 (More Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 12 (Windows Prefetch Files)SPLOIT:Forensics with Metasploit ~ ( Recovering Deleted Files )Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 7 (Windows Sysinternals)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 9 (Finding Storage Device Artifacts in the Registry)News:Airline Offers Frequent Flyer Miles to HackersHack Like a Pro:Digital Forensics Using Kali, Part 2 (Acquiring a Hard Drive Image for Analysis)How To:Why You Should Study to Be a HackerNews:What to Expect from Null Byte in 2015Hack Like a Pro:Digital Forensics Using Kali, Part 3 (Creating Cases in Autopsy & Sleuth Kit)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 16 (Extracting EXIF Data from Image Files)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 4 (Evading Detection While DoSing)News:Sneaky! WhatsApp Adds Encryption to iCloud Backups on the SlyNews:Becoming a HackerHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)Hack Like a Pro:Getting Started with BackTrack, Your New Hacking SystemHow To:Recover deleted text messages on an iPhoneHacking Windows 10:How to Find Sensitive & 'Deleted' Files RemotelyHack Like a Pro:How to Hack Facebook (Facebook Password Extractor)How To:Edit Super Mario World levels with Lunar MagicHow To:Don't Get Caught! How to Protect Your Hard Drives from Data ForensicsGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking Simulations