After­wards: See Ana­lyz­ing memory

Linux

Prozess memory dump

Find out which mem­o­ry seg­ments are used by an appli­ca­tion via its PID:

cat /proc/<pid>/maps

Dump the used mem­o­ry from an appli­ca­tion: (cred­it)

#!/bin/bash

grep rw-p /proc/$1/maps \
| sed -n 's/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p' \
| while read start stop; do \
  gdb --batch --pid $1 -ex \
    "dump memory $1-$start-$stop.dump 0x$start 0x$stop"; \
done

Complete memory dump

fmem

Requires root priv­i­leges. Could be out­dat­ed and not work on new­er lin­ux machines.

1. Down­load fmem ker­nel mod­ule: https://github.com/NateBrune/fmem
2. make && ./run to com­pile and add it to the kernel
3. dd if=/dev/fmem of=memory.dd bs=1MB count=512 — for 512 MB RAM. Adjust accordingly.

lime

1. git clone https://github.com/504ensicsLabs/LiME
2. cd src
3. make
4. Load the mod­ule and cre­ate the image: 
   1. Into a local file: ins­mod lime-<generated-module>.ko “path=/<output-file>.mem format=lime”
   2. Into a remote file: 
      1. On the vic­tim: ins­mod lime-<generated-module>.ko “path=tcp:4444 format=lime”
      2. On the tar­get: nc <vic­tim-ip> 4444 > system.mem
5. Cre­at­ing a sys­tem pro­file (maybe: apt-get install dwarfdump): 
   1. git clone https://github.com/volatilityfoundation/volatility.git
   2. cd volatility/tools/linux
   3. make
   4. zip <system-name>.zip module.dwarf /boot/Sys­tem-map-of-cur­rent-ker­nel
   5. Copy <system-name>.zip to the tar­get server.
6. On the tar­get server: 
   1. Copy <system-name>.zip into the plugins/overlays/linux/ directory.
   2. Make sure that the new pro­file is loaded with python vol.py –info | grep <sys­tem-name>

Recall

Frame­work for mem­o­ry inves­ti­ga­tion: https://github.com/google/rekall

Cheat sheet: https://digital-forensics.sans.org/media/rekall-memory-forensics-cheatsheet.pdf

Could­n’t build on a Vm. hm…

Windows

Files, which also con­tains memory:

• C:\pagefile.sys
• C:\swapfile.sys
• C:\hiberfil.sys
• C:\Windows\memory.dmp

WinPmem

Open Source pyh­si­cal acquisition.

GitHub — Velocidex/WinPmem: The mul­ti-plat­form mem­o­ry acqui­si­tion tool.

Exterro FTK Imager

Magnet DumpIt