Downloaded 62 times
Uploaded bySatria Ady Pradana
(Workshop) Memory Forensic - Investigating Memory Artefact
The document provides an overview of memory forensics, focusing on Windows memory acquisition and analysis using tools like Volatility. It outlines various stages, techniques for memory dumping, and essential commands for examining memory artifacts. Additionally, it discusses both software and hardware acquisition methods and includes practical examples for performing memory analysis.
More Related Content
Similar to (Workshop) Memory Forensic - Investigating Memory Artefact
(Workshop) Memory Forensic - Investigating Memory Artefact
- 1. Memory Forensic Investigating MemoryArtefact http://xathrya.id/ 1 Satria Ady Pradana@ Universitas Atma Jaya Yogyakarta 29 April 2017 Workshop
- 2. # Whoami? • CyberSecurity Consultant at Mitra Integrasi Informatika (MII) • Researcher at dracOs Dev Team • Coordinator of Reversing.ID http://xathrya.id/ 2
- 3. Organization • Divided tosome sections related to forensic stages. • Each section has objectives • Has background explanation if necessary http://xathrya.id/ 3
- 4. Overview • Engage inpractical forensic activity • Acquisition – Windows Memory Acquisition • Analysis – Process & DLLs – Registry – Connections http://xathrya.id/ 4
- 5. Assumption • Have understandingof simple UNIX command (explained in previous workshop) http://xathrya.id/ 5
- 6. Windows Brief Introduction toOur Target’s Internal http://xathrya.id/ 6
- 7. Volatility Tools of theTrade http://xathrya.id/ 7
- 8. Profile? • Each operatingsystem has different internal structure • Event for minor version different • Volatility needs to know what type of system our memory dump came from, so it knows which data structures, algorithms, and symbols to use. • List all profiles $ vol.py --info http://xathrya.id/ 8
- 9. Command Line • Typicalcommand $ vol.py –f memdump.img --profile profile plugins • Every command / task is implemented as plugin http://xathrya.id/ 9
- 10. Preliminary $ export VOLATILITY_PROFILE=Win7SP0x86 $export VOLATILITY_LOCATION=file:///tmp/image.img $ vol.py pslist $ vol.py files http://xathrya.id/ 10
- 11. 0x1 Acquisition Objectives: • Understandingthe memory (RAM) and volatile data. • Understanding the acquisition technique for memory forensic. • Know how to dump memory on Windows http://xathrya.id/ 11
- 12. • Acquisition canbe hardware based or software based. • Hardware based, require special hardware and has capability of DMA. – Firewire (IEEE 1394) • But we are talking about software based. http://xathrya.id/ 12
- 13. Tools • DumpIt &Hibr2Bin • Winpmem http://xathrya.id/ 13
- 14. Image Format • Raw •Crash Dumps • Hibernate http://xathrya.id/ 14
- 15. Using DumpIt &Hibr2Bin Producing crash dump > DumpIt.exe Converting Hibernate File > Hibr2Bin.exe http://xathrya.id/ 15
- 16. Using Winpmem Producing dumpin AFF4 compression > winpmem.exe -o imagedump.aff4 Export to raw from AFF4 > winpmem.exe imagedump.aff4 –export PhysicalMemory -o memory.img Producing raw dump > winpmem.exe imagedump.aff4 –export PhysicalMemory -o memory.img http://xathrya.id/ 16
- 17. Vmware Memory Dump •Applied to OS running on top of Vmware • To generate memory dump, we should suspend the running VM – It will generate a .vmem file http://xathrya.id/ 17
- 18. VirtualBox Memory Dump •Applied to OS running on top of VirtualBox • Start VM and use Vboxmanage $ vboxmanage debugvm “GuestVM” dumpguestcore --filename dump.elf http://xathrya.id/ 18
- 19.
- 20. • Gain informationabout memory dump $ vol.py imageinfo http://xathrya.id/ 20
- 21. PROCESS & DLL View& Dump http://xathrya.id/ 21
- 22. View • List allprocess $ vol.py pslist $ vol.py psscan $ vol.py pstree $ vol.py psxview $ vol.py privs Different? http://xathrya.id/ 22
- 23. View • List allthreads $ vol.py threads $ vol.py thrdscan Different? http://xathrya.id/ 23
- 24. View • List modules/librariesof process (ex: pid 135) $ vol.py dlllist –p 135 http://xathrya.id/ 24
- 25. Dump • Dump process $vol.py procdump -p 135 --dump-dir /tmp/procdump • Dump DLL $ vol.py dlldump -p 135 –dump-dir /tmp/dlldump http://xathrya.id/ 25
- 26.
- 27. • List connectionsmade $ vol.py connscan $ vol.py netscan • List opened sockets $ vol.py sockets $ vol.py sockscan http://xathrya.id/ 27
- 28.
- 29. View $ vol.py hivelist $vol.py hivescan http://xathrya.id/ 29
- 30.
- 31. • Scan openedfiles in memory $ vol.py files • Dump files $ vol.py dumpfiles http://xathrya.id/ 31
- 32.