[Day 4] 1. Memory Forensics

Memory forensics involves analyzing volatile data captured from the memory (RAM) of a system to uncover evidence of malicious activity, user actions, or system state.

Memory Image Files

• Memory images typically have the file extensions:
  • Copy

    .mem

  • Copy

    .raw

Key Plugins/Commands for Memory Analysis

Here are common plugins or tools used for analyzing memory images. These are often employed using tools like Volatility or within forensic frameworks:

1. amcache: Analyzes the application compatibility cache for evidence of executed applications.
2. cmdline: Displays the command-line arguments of processes.
3. cmdscan: Lists commands entered in open command-line windows.
4. connscan: Scans for active network connections.
5. consoles: Displays console input/output data.
6. envars: Lists environment variables for processes.
7. filescan: Scans for file handles within memory.
8. getsids: Retrieves Security Identifiers (SIDs) associated with processes.
9. hashdump: Dumps password hashes from memory for offline cracking.
10. hivescan: Scans the memory for registry hive structures.
11. lsadump: Extracts data from the Local Security Authority (LSA), often for credential analysis.
12. shellbags: Identifies processes that interacted with specific shell objects (folders, files).
13. sockets: Scans for active network sockets.
14. verinfo: Displays version information of executables or modules in memory.

**Scanning Memory Images Using Autopsy

General Workflow:

1. Ensure the memory image file is in the correct directory.
2. Load the memory image(volatility) file into Autopsy
3. Select the plugins to use (from the checklist above).
4. Keep the profile section as "auto-detect" for most cases.
5. Start the scan.

Forensic tools like Autopsy often leverage Volatility 3 in the background for memory analysis.

Using Volatility Directly

To analyze a memory dump using Volatility:

bashCopy
# Navigate to the directory where the Volatility files are located.
vol.py -f newmem.mem windows.info.Info

This command provides system information about the memory image (

newmem.mem

windows.info.Info

Capturing Memory Images

Using FTK Imager to capture memory:

1. Go to File → Capture Memory.
2. Fill in the necessary details (e.g., output location, options for page file capture).
3. Click on Capture to save the memory image.
4. For VMs, repeat the same steps to capture memory from the virtual machine.

Analyzing Memory Images in Autopsy

1. Load the memory image into Autopsy.
2. Add it as a Data Source.
3. Expand the data sources section to view plugin-specific results.

Hash Cracking Tools

• Use CrackStation.net to crack password hashes extracted from memory dumps.

Hex Editors and File Headers

Hex editors allow detailed analysis of binary files and memory dumps. Popular tools include:

• HxD Hex Editor
• FileInsight
• Hex Workshop

Common Operations:

1. Analyze file headers:
   • File headers are sequences of bytes at the beginning of files that identify the file type.
   • Example:
     • JPEG:
       Copy

       FFD8FF

     • PDF:
       Copy

       %PDF

   • Knowing these can help identify partial or corrupted files in memory.
2. Manipulate data through:
   • Bit shifting
   • Block shifting
   • These operations can be useful for analyzing encrypted or obfuscated data.

Bit Rot vs. Bit Rotation

• Bit Rot: Gradual degradation of data stored on magnetic storage media due to physical or environmental factors (e.g., magnetic decay).
  • Prevention: Regularly refresh or replace aging storage media (e.g., tapes).
• Bit Rotation: A computational operation where bits in a binary sequence are shifted circularly.