[Day 3] 2. Memory Forensics

1. Information Stored in RAM for Forensics:

• RAM can contain critical evidence such as:
  • Running processes: Information about active programs, including their memory usage.
  • Network connections: Data on open connections and communication channels.
  • Encryption keys: Stored or cached cryptographic keys.
  • Credentials: Active user logins and authentication tokens.
  • Temporary files: Data from ongoing or recent activities that may not be saved to disk.
  • System artifacts: Information about the system’s configuration, hardware, and software.
• RAM contents are volatile, meaning they are lost once the system is powered down, making it crucial for forensic investigators to capture memory as soon as possible after an incident.

2. Volatility3 Framework:

• Volatility3 is an open-source tool for memory forensics.
• Written in Python, it helps investigators analyze memory dumps and extract data from volatile memory (RAM) without relying on the file system.
• Useful for extracting information about running processes, network connections, and more.
• Volatility3 is an evolution of the original Volatility framework and it supports the analysis of a broader range of memory dumps and file formats.

3. SIFT Workstation:

• The SIFT (SANS Investigative Forensic Toolkit) workstation is a specialized forensic analysis system designed for investigators.
• Although very powerful, it is known to be quite heavy and may require significant system resources.
• SIFT includes many open-source tools and is often used in tandem with other forensic tools for complete investigations. It might be helpful to note that the "heavy" nature refers to its resource requirements when analyzing large datasets, which could be an issue on lower-spec machines.

4. Enabling Memory Forensics in Autopsy:

• Autopsy is a popular open-source digital forensics platform.
• To enable memory forensics:
  • Navigate to
    Copy

    Tools

    ->
    Copy

    Plugins

    ->
    Copy

    Installed

    -> Activate the
    Copy

    Experimental

    plugin.
  • After activation, you'll have the option to select
    Copy

    Memory Image (Volatility)

    for analysis.

5. Homework: How to Capture Live Memory in Linux?

• To capture live memory in Linux, tools like LiME (Linux Memory Extractor) are commonly used.
  • LiME allows for the acquisition of physical memory from a live Linux system, useful for forensic investigations.
  • The captured memory can be analyzed using tools like Volatility or other memory forensics frameworks.
  • LiME supports both physical memory extraction (to a file) and the use of memory dump formats compatible with Volatility.