a teaching of memory forensics

1. ISAC Certified Forensic Investigator (ICFI) @ISAC
Volatile Memory Forensics
Module-7:
Memory Forensics using Volatility

2. Memory Forensics
Importance of Memory Forensics
Memory Analysis Tool
Analysis of Windows 7 RAM
using Volatility 3
Understand the Suspect and
Accounts
Understand the Suspect’s PC
Network Forensics
Investigate Command History
Investigate Suspect’s USB
Overview
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

3. Volatile data resides in a computer’s short term memory storage and can include data like
browsing history, chat messages, crash reports, security compromise and clipboard contents.
Memory forensics (sometimes referred to as memory analysis) refers to the analysis of volatile
data in a computer’s memory dump (or core dump) which is snapshot capture of computer
memory data at a specific instant.
Memory dump analysis is a very important step of the Incident Response process.
Information security professionals conduct memory forensics to investigate and identify
attacks or malicious behaviors that do not leave easily detectable tracks on hard drive data.
The RAM (memory) dump of a running compromised machine usually very helpful in
reconstructing the events/activities that the attacker performed on the machine.
Memory Forensics
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

4. Memory forensics can provide unique insights into runtime system activity, including open
network connections and recently executed commands or processes.
Any program – malicious or otherwise – must be loaded in memory in order to execute,
making memory forensics critical for identifying otherwise obfuscated attacks.
In many cases, critical data pertaining to attacks will exist solely in memory, for example:
 Network connections
 Account credentials
 Chat messages
 Encryption keys
 Running processes
 Injected code fragments
 internet history
Importance of Memory Forensics
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

5. Memory Acquisition : The process of acquiring volatile memory to non-volatile storage (to file
on disk).
On Physical Machine (Tools):
 FTK Imager
 Belkasoft Ram Capturer
 Memoryze by FireEye
 WinPmem
 Dumpit by MoonSols (Windows Memory)
On Virtual Machine (Tools):
 Suspend the VM (.vmem)
Memory Acquisition Tools
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

6. ISAC Certified Forensic Investigator (ICFI) @ISAC
— h
The Volatility Framework is open-source and written in Python. Downloads are available in zip
and tar archives, Python module installers, and standalone executables.
It can analyze raw dumps, crash dumps, VMware dumps (.vmem), virtual box dumps, and
many others.
It supports analysis for Linux, Windows, Mac, and Android systems.
Volatility 3 installation:
• git clone https://github.com/volatilityfoundation/volatility3.git
• cd volatility3
• python3 setup.py
Memory Analysis Tool
The installation will fail if you have a new Kali
version 2020.4, you can jump to next slide

7. Volatility Help
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

8. Identify the OS Information
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

9. Investigation
Understand the Suspect and Accounts
Understand the Suspect’s PC
Network Forensics
Investigate Command History
Investigate Suspect’s USB
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

10. Understand the Suspect & Accounts
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

11. Who was using the Device?
Physical file location = {subkeys of active user
profile}
=HKEY_USERS <SID> (linked to by HKEY_CURRENT_USER)
• SID: Security Identifier: a unique, immutable identifier of a user,
user group, or other security principal.
• Users can change names but not SID
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

12. Who are associated with the suspect device?
• Sam – HKEY_LOCAL_MACHINESAM
• Security – HKEY_LOCAL_MACHINESECURITY
• Software – HKEY_LOCAL_MACHINESOFTWARE
• System – HKEY_LOCAL_MACHINESYSTEM
• Default – HKEY_USERS.DEFAULT
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC
SID Name Description
S-1-5-18 Local System A service account that is used by the operating system.
S-1-5-19 NT Authority Local Service
S-1-5-20 NT Authority Network Service
S-1-5-21 Administrator/Guest A user account for the system administrator.
SID
format
details

13. Who has SID= S-1-5-21-1716914095-909560446-1177810406-1002?
SSHD_Server is an account made by an SSH
server.., It allows remotely log in to the
computer.
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

14. Who has SID= S-1-5-21-1716914095-909560446-1177810406-1000?
It could be interesting to list the processes using a privileges SID (and the processes using some service
SID).
python vol.py -f memdumpWin7.mem windows.getsids
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

15. Who is the default logon user?
Default automatically log
on
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

16. Hive Overview
Each user has a profile (ntuser.dat)
• Keys under HKLMSYSTEMCurrentControlSetControlhivelist
• Point to HKEY_LOCAL_MACHINESYSTEM
• Point to HKEY_LOCAL_MACHINEHARDWARE
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

17. HKEY_USERS (HKU)
Contains information about all the users who
logged in to the computer at some point
When log on, the current logged in user profile
is linked by HKCU
Saved in each user's profile folder
C:UsersIEUserNtuser.dat C:
Usersssh_ServerNtuser.dat C:
UsersDefault UserNtuser.dat
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

18. HKEY_CURRENT_USERS (HKCU)
Does not contain any data
A link to the subkey of HKEY_USERS
Stores settings for currently logged-in user
Unloaded when the user logs out
If no profile is available, built from default user
Control everything of the current logged user
Environment variables
Desktop settings,
Network connections, printers,
Application preferences.
Keyboard layout
Current logged user
information
Treasure for investigators
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

19. HKEY_LOCAL_MACHINE (HKLM)
Contains computer hardware and software information
Loaded at boot time from hard disk
• Store Plug-and-Play devices Infor
• Created dynamically, not stored in a
fil
e
Loaded at boot time
from
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

20. Understand the Suspect’s PC
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

21. Where to find CPU information of Suspect’s PC?
Find key = “DESCRIPTIONCentralProcessor0”
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC
If your system has multiple processors, they
are all listed as subkeys under this key. If your
system has only one processor, it is listed as
processor 0.

22. Where to find CPU information of Suspect’s PC?
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC
Print key starts from offset 0x87c459c8. Offset can be skipped

23. What is the name of Suspect’s device?
Note: On a live registry, you will see
“CurrentControlSet” instead of “ControlSet001”.
Because it is not a live, we need to check
ControlSet001
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

24. What is the Time Zone Information?
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

25. What is the Last Shutdown Time?
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

26. What is the USB Device?
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

27. Program Executions
 Windows systems maintain a set of keys in the registry database
(UserAssist keys) to keep track of programs that executed.
 The number of executions and last execution date and time are available
in these
keys.
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

28. Network Forensics
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

29. Suspicious IPs connect to PC
NetScan: Scans network objects (open network connections) present in the
memory
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

30. Process Name of the Suspicious IP
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC
Find out process name with pid 4

31. Installing YaraScan Plugin
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC
YaraScan is a tool aimed at (but not limited to) helping malware researchers to identify and
classify malware samples. It scans kernel memory using Yara rules.
 pip install yara-
python
 pip install pycrypto
 pip install pefile
 pip install capstone
Dependencies

32. Investigate Command History
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

33. Investigate Command History
Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC

34. Volatile Memory Forensics ISAC Certified Forensic Investigator (ICFI) @ISAC