Hack Like a Pro: Digital Forensics for the Aspiring Hacker, Part 15 (Parsing Out Key Info from Memory) « Null Byte :: WonderHowTo

Welcome back, my budding hackers!Digital forensics is one of IT's most rapid-growing disciplines. All hackers should be familiar withdigital forensicsif for no other reason than to protect themselves. More than one hacker has been apprehended because they were unaware of the evidence trail they left behind.Inmy previous tutorial in this series, we looked at how to grab a forensic image of the RAM andpagefile.sysof a Windows system. We then used the open-source tool Volatility on our Kali OS to parse the type of image and the registry hives.In this tutorial, we will look to find other information on that image that we can parse out that may have forensic significance. As we know, there is voluminous amount of information in the RAM of a running system that can reveal what the suspect was doing at the time of the system capture. This would include, of course, much of the same information we can get fromSysinternalsfrom a running system, but here we are working with a memory image and not a running system. In most forensic investigations of a suspect's computer, we are working with a forensic image of the RAM and not the running system.Before we start here, I am assuming that you have captured the memory image with one of the many memory-capturing tools such asFTK Imagerand have parsed out the profile from the image withVolatility.Parsing out the image profile is crucial, as each operating system stores information in different places in RAM. Volatility needs to know the profile (OS, service pack, and architecture) to know where to look in the memory image for the necessary information. If you put in the wrong profile information, Volatility will throw errors telling you it can't parse the information properly. In that case, try another image profile. Unfortunately, the profile image that this tool provides is not always correct.Step 1: Getting the List of ProcessesAs our first step, let's see if we can find the processes that the suspect had running when we captured the RAM image. We can do this by typing:kali > python vol.py --profile Win7SP1x64 pslist -f /root/Desktop/memdump.memLet's break that down:pythonis the interpreter.vol.pyis the name of the Volatility script.--profile Win7SP1x64is the profile of the system the memory image was captured from.pslistis the plugin to parse out the running processes.-f /root/Desktop/memdump.memis the location of the image file.As you can see, Volatility has parsed out all the running processes. To gather even more information from the RAM image, we can use exactly the same command as above with the exception of changing the name of the plugin.To get a list of available plugins you could use, type:kali > python vol.py -hStep 2: Getting the Running DLLsTo view the running DLLs on the system, we simply use thedlllistplugin like below:kali > python vol.py --profile Win7SP1x64 dlllist -f /root/Desktop/memdump.memAs you can see, Volatility parsed out a list of all the running DLLs.Step 3: Getting the Contents of the System's ClipboardSometimes, what the suspect had in their clipboard can be incriminating. We can retrieve the information from the suspect's RAM by using theclipboardplugin like below.kali > python vol.py --profile Win7SP1x64 clipboard -f /root/Desktop/memdump.memUnfortunately, all this information is in hexadecimal and must be translated to ASCII.Step 4: Getting a Timeline of EventsOften times, to prove that a suspect actually committed the action they are accused of, we may need a timeline of events that took place on that system. We can retrieve this timeline information from the memory image by using thetimelinerplugin like below.kali > python vol.py --profile Win7SP1x64 timeliner -f /root/Desktop/memdump.memNote that each process is time stamped.Step 5: Looking for Malware in the MemoryLastly, let's look for any malware running in the memory of the suspect system. Volatility has a plugin especially designed for this purpose, appropriately namedmalfind. We can use it like any other Volatility plugin. Simply type the same command as above but replace the name of the plugin with malfind.kali > python vol.py --profile Win7SP1x64 malfind -f /root/Desktop/memdump.memAs you can see, this suspect had numerous pieces of malware running on their system. This information may actually be exculpating as the presence of malware would indicate that someone else had control of the system and may have committed the actions the suspect is accused of.Keep coming back, my budding hackers, as we explorethe world of digital forensics. Be safe!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 6 (Using IDA Pro)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 12 (Windows Prefetch Files)How To:The Essential Skills to Becoming a Master HackerNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 8 (More Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 14 (Live Memory Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 11 (Using Splunk)News:Why YOU Should Study Digital ForensicsHow To:Become a Computer Forensics Pro with This $29 TrainingHack Like a Pro:Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 7 (Windows Sysinternals)Hack Like a Pro:Hacking the Heartbleed VulnerabilityHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 9 (Finding Storage Device Artifacts in the Registry)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 12 (Loadable Kernel Modules)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)News:Airline Offers Frequent Flyer Miles to HackersNews:What to Expect from Null Byte in 2015News:Sneaky! WhatsApp Adds Encryption to iCloud Backups on the SlyHack Like a Pro:Reconnaissance with Recon-Ng, Part 1 (Getting Started)Hack Like a Pro:How to Build Your Own Exploits, Part 1 (Introduction to Buffer Overflows)Hack Like a Pro:Digital Forensics Using Kali, Part 2 (Acquiring a Hard Drive Image for Analysis)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 2 (Keywords)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 4 (Evading Detection While DoSing)Hacker Hurdles:DEP & ASLRHow To:Why You Should Study to Be a HackerGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsNews:Indie and Mainstream Online Games Shut Down by LulzSecCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsNews:Day 2 Of Our New WorldCommunity Byte:HackThisSite, Realistic 4 - Real Hacking Simulations