Category: Memory Acquisition

WinPmem

Posted on by randrada

Memory Acquisition using Velocidex Enterprise - WinPmem

Velocidex WinPmem Github
Download WinPmem
WinPmem Releases
Click here to view Velocidex WinPMem use cases

WinPmem is a physical memory acquisition tool allowing investigator to recover and analyze valuable artifacts that are often only found in memory.

WinPmem has its following features:

      • Open Source
      • Support for WinXP – Win10, x86, x64. The WDK7600 can be used to include WinXP support. As default, the provided WinPmem executables will be compiled with WDK10, supporting Win7 – Win10, and feature more modern code.
      • Three different independent method to create memory dump. One method should always work even when faced with kernel mode rootkits.
      • Raw memory dump image support.
      • A read device interface is used instead of writing the image from the kernel like some other imagers. This allows us to have complex userspace imager (e.g. copy across network, hash etc), as well as analysis on the live system(e.g. can be run directly on the device).

In an incident response perspective, the volatile data residing inside the system’s memory contains rich information such as passwords, credentials, network connection, malware intrusions, registry hives and etc that can be a valuable source as an evidence and not typically stored on the local hard disk. This is one of the investigator’s favorite data source to perform digital forensics and knowing the right tool to dump memory is a must.

Related Topic

Magnet RAM Capture

Posted on by randrada

Memory Acquisition using Magnet Forensics - RAM Capture

Download Magnet RAM Capture
Click here view Magnet Forensics RAM Capture use cases

Magnet RAM Captuer is a free imaging tool designed to capture the physical memory of a suspect’s computer, allowing investigators to recover and analyze valuable artifacts that are often only found in memory.

Magnet RAM Capture has a small memory footprint, meaning investigators can run the tool while minimizing the amount of data that is overwritten in memory. You can export captured memory data in Raw (.DMP/.RAW/.BIN) format and easily upload it into leading analysis tools, including Magnet AXIOM and Magnet IEF.

Why Memory Dump?

Volatile memory can reveal a lot of important information about a system and its users. There are often instances where evidence stored in memory is never written to the hard drive and may only be found in pagefile.sys and hiberfil.sys. Memory analysis is essential to many malware and intrusion incidents and can be imperative in recovering valuable evidence for almost any PC investigation. Running processes and programs, active network connections, registry hives, passwords, keys, and decrypted files are just a few examples of the evidence that can be found in memory. Many web apps, like Gmail, or private/incognito browsing modes, will only store data in memory, meaning the evidence cannot be recovered from the hard disk. (source: https://www.magnetforensics.com/blog/acquiring-memory-with-magnet-ram-capture/).

From an incident response perspective, the volatile data residing inside the system’s memory contains rich information such as passwords, credentials, network connections, malware intrusions, registry hives, and etc. that can be a valuable source of evidence and is not typically stored on the local hard disk. This is one of the investigator’s favorite data sources to perform digital forensics on, and knowing the right tool to dump memory is a must.

 

Related Topic

AccessData FTK

Posted on by randrada

Memory Acquisition using AccessData - FTK

Download FTK Imager 4.7
Click here to view FTK Imager use cases

FTK Imager is a data preview and imaging tool used to acquire data(evidence) in a forensically sound manner by creating copies of data without making changes to the original evidence. FTK Imager 4.5 includes faster image creation, additional evidence processing improvements including XFS file system support, improvements to the command line, disk imaging , evidence parsing, and memory dump.

Why Memory Dump?

Volatile memory, or RAM, is used to store data currently used by a running process: whether it is a user application or a system service. This type of memory is much quicker than a regular hard drive, but unlike files permanently stored on a drive(unless deleted), data from RAM may disappear instantly. At the time, it may store data crucial for your case, including passwords in raw format without encryption or encoding, decrypted data otherwise kept encrypted on a drive, decryption keys for various services, apps, and WDE, remote session data; chats in social networks; malware code; cryptocurrency transactions; various system info such as loaded registry branches; and so on.(source: https://belkasoft.com/ram-dumping-tool-selection)

From an incident response perspective, the volatile data residing inside the system’s memory contains rich information such as passwords, credentials, network connections, malware intrusions, registry hives, and etc. that can be a valuable source of evidence and is not typically stored on the local hard disk. This is one of the investigator’s favorite data sources to perform digital forensics on, and knowing the right tool to dump memory is a must.

Related Topic

Dumpit

Posted on by randrada

Memory Acquisition using MoonSols - DumpIt.exe

Download DumpIt.exe

DumpIt is a tiny free utility tool that is used to generate a physical memory dump of Windows machines. It works with both x86 and x64 machines. The raw memory dump is generated in the current directory; only a confirmation question is prompted before starting. This is perfect for deploying the executable on USB keys for quick incident response needs.

Why Memory Dump?

Volatile memory, or RAM, is used to store data currently used by a running
process: whether it is a user application or a system service. This type of memory is much quicker than a regular hard drive, but unlike files permanently stored on a drive(unless deleted), data from RAM may disappear instantly. At the time, it may store data crucial for your case, including passwords in raw format without encryption or encoding, decrypted data otherwise kept encrypted on a drive, decryption keys for various services, apps, and WDE, remote session data; chats in social networks; malware code; cryptocurrency transactions; various system info such as loaded registry branches; and so on.(source: https://belkasoft.com/ram-dumping-tool-selection)

From an incident response perspective, the volatile data residing inside the
system’s memory contains rich information such as passwords, credentials, network connections, malware intrusions, registry hives, and etc. that can be a valuable source of evidence and is not typically stored on the local hard disk. This is one of the investigator’s favorite data sources to perform digital forensics on, and knowing the right tool to dump memory is a must.

Related Topic

This is a GUI-based tool, which is easy to use.

After executing the DumpIt.exe tool, it will prompt with a question.

Hit “y” to proceed, then a live RAM capture will be dumped.

#note: This may take a while depending on the resources on your system you’re working on.

 

Belkasoft RamCapture

Posted on by randrada

Memory Acquisition using Belkasoft - Live RAM Capture

Download Belkasoft Live RAM Capturer
Click here to view Belkasoft RamCapture uses cases

Belkasoft Live RAM Capturer is a tiny free forensic tool that allows you to reliably extract the entire contents of a computer’s volatile memory-even if protected by anti-debugging or anti-dumping system. Belkasoft RAM Capturer is compatible with all versions and editions of Windows, including XP, Vista, Windows 7, 8, and 10, 2003, and 2008 Server.

Why Memory Dump?

Volatile memory, or RAM, is used to store data currently used by a
running process: whether it is a user application or a system service.
This type of memory is much quicker than a regular hard drive, but
unlike files permanently stored on a drive(unless deleted), data from
RAM may disappear instantly. At the time, it may store data crucial for
your case, including passwords in raw format without encryption or
encoding, decrypted data otherwise kept encrypted on a drive, decryption
keys for various services, apps, and WDE, remote session data; chats in
social networks; malware code; cryptocurrency transactions; various
system info such as loaded registry branches; and so on.(source: https://belkasoft.com/ram-dumping-tool-selection)

From an incident response perspective, the volatile data residing inside the system’s memory contains rich information such as passwords, credentials, network connections, malware intrusions, registry hives, and etc. that can be a valuable source of evidence and is not typically stored on the local hard disk. This is one of the investigator’s favorite data sources to perform digital forensics on, and knowing the right tool to dump memory is a must.

Related Topic