introduction to memory forensics

Click here to load reader

Upload: marco-alamanni

Post on 22-Jan-2018

180 views

Category:

Software

5 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: Introduction to memory forensics

Digital forensics with Kali Linux

Marco Alamanni

Section 6

Memory forensics

www.packtpub.com

In this Section, we are going to take a look at…

• Introduction to virtual memory.

• Acquiring a RAM image.

• Analyzing a memory image with the Volat i l i ty framework.

Page 3: Introduction to memory forensics

Course Name

Author Name

Video 6.1

Introduction to memory forensics

In this Video, we are going to take a look at…

● Virtual memory management and paging.

• Introduction to memory forensics.

Introduction to memory forensics

● Memory forensics is the process of acquiring and analyzing the main memory of a system.

● Very important in the live response process, investigating an intrusion or a malware infection.

Allows to collect and examine volatile artifacts that in some cases exist only in memory.

Page 6: Introduction to memory forensics

Introduction to virtual memory

● Virtual memory overcomes the limits of physical memory and maps logical to physical memory addresses.

● Virtual memory is divided into chunks called pages.

● The page table mantains the mapping between pages and the relative physical page frames.

Page 7: Introduction to memory forensics

Introduction to virtual memory

● Pages are swapped to disk when physical memory lacks according to a page replacement algorithm.

● A page fault is generated when a process refers a logical address of a swapped page.

● The memory manager reads the page from disk and loads it to memory.

Page 8: Introduction to memory forensics

Introduction to virtual memory

● Windows page file is %SYSTEMDRIVE%\pagefi le.sys while Unix and Linux use the swap partition.

● The hibernation file stores the contents of RAM before the OS goes to hibernation state.

● On Windows is located at %SYSTEMDRIVE\hiber f i l .sys while Linux generally uses the swap partition.

Page 9: Introduction to memory forensics

Next Video

Memory acquisition

Page 10: Introduction to memory forensics

Next Video

Memory acquisition

Theory and practice of flash memory mobile forensics · Proceedings of the 7 th Australian Digital Forensics Conference 52 | Page Theory and practice of flash memory mobile forensics

Detecting Malware With Memory Forensics - Deer Run

Memory Forensics for QQ from a Live System

Memory Forensics: Collecting & Analyzing Malware Artifacts from … · 2016. 10. 23. · Memory Forensics: Collecting and Analyzing Malware Artifacts from RAM . Volatility Modules

Memory Forensics for Incident Response

Physical Memory Forensics

Memory Forensics Analysis Poster … · Memory Forensics Analysis Poster The Battleground Between Offense and Defense digital-forensics.sans.org Poster_FOR526_v2.2_12-18 Rekall Memory

Hunting Mac Malware with Memory Forensics

EXTRACTING RANSOMWARE’S KEYS BY UTILIZING MEMORY FORENSICS

Memory Grabber' Forensics Tool (SRA Int'l)

Physical Memory Forensics - Black Hat · Physical Memory Forensics Mariusz Burdach. Overview •Introduction •Anti-forensics •Acquisition methods •Memory analysis of Windows

Memory Forensics with Hyper-V Virtual Machines - DFRWS · Memory Forensics with Hyper-V Virtual Machines By ... Memory Forensics with Hyper-V Virtual Machines By: ... //media.blackhat.com/bh-dc-11/Suiche/BlackHat_DC_2011

Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Schuster Windows Memory Forensics with Volatilitycomputer.forensikblog.de/files/talks/FIRST2009-Windows_Memory... · Title: Schuster_Windows Memory Forensics with Volatility Author:

openioc_scan - IOC scanner for memory forensics

Practical Reversing III – Malware Memory Forensics

Malware Memory Forensics

Defeating Windows memory forensics

Introduction to IT Forensics and Forensics Process 1

Memory Forensics Malware Detection - GitHub Pagestristartom.github.io/teaching/15s-cis700/others/memanalysis.pdf · Memory Forensics Per Wikipedia, Memory forensics is forensic analysis

Physical Memory Forensics - Black Hat | Home

Memory Forensics - · PDF fileMemory Forensics . Dmitry Vostokov ... Inter-Regional Inter-University Open Computer Security Contest . Forensics . ... Pattern Classification

Applying Memory Forensics to Rootkit Detection

Windows Memory Forensics and DKOM - Jesse Kornblumjessekornblum.com/presentations/ts10.pdf · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum

Memory Forensics - publish.illinois.edupublish.illinois.edu/.../files/2014/03/acc-forensics.pdfWhat is Computer Forensics? Mobile Device Forensics Network Forensics Memory & Data Forensics

Memory forensics using VMI for cloud computing

Memory Forensics With Volatility

An Introduction to Memory Forensics COPYRIGHTED MATERIAL€¦ · 4 Part I: An Introduction to Memory Forensics Typically, operating systems also implement a set of high-level services

Live Memory Forensics on Android With Volatility

Memory Forensics & Security Analytics: Detecting Unknown ... · Memory Forensics & Security Analytics: Detecting Unknown Malware ... Any malware that is not detected by traditional

Memory Forensics - DumpAnalysis€¦ · Memory Forensics . Dmitry Vostokov . Software Diagnostics Institute . Facebook LinkedIn Twitter Presented at VolgaCTF, Russia Inter-Regional

Memory Forensics for QQ from a Live System · Memory forensics is aimed at analyzing the physical memory from the target computer. It is possible to extract useful message from memory,

Unmasking Careto through Memory Forensics (video in description)

Memory Forensics Analysis Poster - Incident Response Training · Memory Forensics Analysis Poster The Battleground Between Offense and Defense digital-forensics.sans.org DFPS_FOR526_v2.5_4-19

Physical Memory Forensics for Files and Cache€¦ · TRADITIONAL MEMORY FORENSICS » Scan physical memory for evidence of a process (EPROCESS block) » Locate the Directory Table