1 1 00:00:00,660 --> 00:00:03,120 Memory acquisition. 2 2 00:00:03,120 --> 00:00:05,850 Now, as we go through our order of volatility, one 3 3 00:00:05,850 --> 00:00:07,688 of the things we need to collect very early on 4 4 00:00:07,688 --> 00:00:09,780 is our system memory. 5 5 00:00:09,780 --> 00:00:12,570 That stuff that's stored inside of RAM. 6 6 00:00:12,570 --> 00:00:13,530 The way we do this 7 7 00:00:13,530 --> 00:00:16,200 is through system memory image acquisition. 8 8 00:00:16,200 --> 00:00:18,450 This is a process that creates an image file 9 9 00:00:18,450 --> 00:00:20,610 of the system memory that can be analyzed 10 10 00:00:20,610 --> 00:00:22,395 to identify the processes that we're running 11 11 00:00:22,395 --> 00:00:26,220 the contents of temporary file systems, registry data, 12 12 00:00:26,220 --> 00:00:29,790 network connections, cryptographic keys, and much more. 13 13 00:00:29,790 --> 00:00:31,740 Now, there are lots of different ways to do this 14 14 00:00:31,740 --> 00:00:32,573 and we're going to talk 15 15 00:00:32,573 --> 00:00:35,970 about the four most common categories in this lesson. 16 16 00:00:35,970 --> 00:00:39,654 These four categories are live acquisition, crash dump, 17 17 00:00:39,654 --> 00:00:42,755 hibernation files and page files. 18 18 00:00:42,755 --> 00:00:45,150 First, live acquisition. 19 19 00:00:45,150 --> 00:00:46,723 Now, live acquisition is the process 20 20 00:00:46,723 --> 00:00:48,330 of capturing the contents 21 21 00:00:48,330 --> 00:00:50,610 of memory while the computer is running 22 22 00:00:50,610 --> 00:00:54,570 and you do this using specialist hardware or software tools. 23 23 00:00:54,570 --> 00:00:56,520 Now, there are lots of different tools out there 24 24 00:00:56,520 --> 00:00:58,440 but unfortunately, all of these tools 25 25 00:00:58,440 --> 00:00:59,549 need to be pre-installed 26 26 00:00:59,549 --> 00:01:02,160 because they need to have kernel mode drivers 27 27 00:01:02,160 --> 00:01:05,130 to be able to function and get the data out of the system. 28 28 00:01:05,130 --> 00:01:06,420 Now, there's lots of 'em out there 29 29 00:01:06,420 --> 00:01:09,030 but the two that we are going to mention here are memoryze 30 30 00:01:09,030 --> 00:01:11,910 from FireEye and F-Response for TACTICAL 31 31 00:01:11,910 --> 00:01:13,950 Both of these are good tools that you can use 32 32 00:01:13,950 --> 00:01:16,141 to be able to capture the memory contents, but again, 33 33 00:01:16,141 --> 00:01:18,090 they need to be included as part 34 34 00:01:18,090 --> 00:01:21,221 of your build for your workstations across your enterprise 35 35 00:01:21,221 --> 00:01:24,570 so they're ready and waiting when you're ready to use them. 36 36 00:01:24,570 --> 00:01:26,370 Now the second way you can capture the memory 37 37 00:01:26,370 --> 00:01:28,440 is by performing a crash dump. 38 38 00:01:28,440 --> 00:01:30,750 Now essentially, a crash dump is when the contents 39 39 00:01:30,750 --> 00:01:32,700 of memory are written to a dump file 40 40 00:01:32,700 --> 00:01:34,170 when windows encounter some kind 41 41 00:01:34,170 --> 00:01:36,240 of unrecoverable kernel error. 42 42 00:01:36,240 --> 00:01:39,570 These days, most modern computers have a lot of memory. 43 43 00:01:39,570 --> 00:01:41,610 If you look at your standard computer nowadays, 44 44 00:01:41,610 --> 00:01:42,780 they have eight gigabytes 45 45 00:01:42,780 --> 00:01:46,110 or 16 gigabytes or 32 gigabytes of RAM. 46 46 00:01:46,110 --> 00:01:48,510 Now when you have a crash dump happen, 47 47 00:01:48,510 --> 00:01:51,060 it doesn't have time to write all of that to the disc. 48 48 00:01:51,060 --> 00:01:52,950 So instead, you'll usually get the results 49 49 00:01:52,950 --> 00:01:54,630 in a mini dump file. 50 50 00:01:54,630 --> 00:01:56,370 This may contain some valuable information 51 51 00:01:56,370 --> 00:01:58,775 and potential evidence, but it won't be a full-copy 52 52 00:01:58,775 --> 00:02:01,590 of the memory because there's just simply not enough time 53 53 00:02:01,590 --> 00:02:05,040 to write all of that to disk before the system crashes. 54 54 00:02:05,040 --> 00:02:08,340 The third method we have is known as the hibernation file. 55 55 00:02:08,340 --> 00:02:11,130 Now, on every computer, there is a file that will be written 56 56 00:02:11,130 --> 00:02:13,050 to disk whenever the workstation is put 57 57 00:02:13,050 --> 00:02:14,280 into a sleep state. 58 58 00:02:14,280 --> 00:02:16,800 This is known as the hibernation file. 59 59 00:02:16,800 --> 00:02:18,845 Essentially, if you take your laptop and you shut the lid, 60 60 00:02:18,845 --> 00:02:22,050 it creates this hibernation file so that when you open 61 61 00:02:22,050 --> 00:02:24,000 the lid again and you turn on the computer, 62 62 00:02:24,000 --> 00:02:26,640 it can wake up and go right back to what it was doing. 63 63 00:02:26,640 --> 00:02:28,560 Now that hibernation file can be read 64 64 00:02:28,560 --> 00:02:30,207 and analyzed using different forensic tools 65 65 00:02:30,207 --> 00:02:32,070 and this will allow you to go through that 66 66 00:02:32,070 --> 00:02:34,680 and find any information that may have been written there. 67 67 00:02:34,680 --> 00:02:36,420 Now this is a great way to get information 68 68 00:02:36,420 --> 00:02:38,280 but there are some drawbacks too. 69 69 00:02:38,280 --> 00:02:39,745 If you're trying to hunt for malware. 70 70 00:02:39,745 --> 00:02:42,120 Some types of malware can actually detect the use 71 71 00:02:42,120 --> 00:02:43,950 of a sleep state, and because of that, 72 72 00:02:43,950 --> 00:02:46,830 they'll perform any forensics to try to hide their activity. 73 73 00:02:46,830 --> 00:02:48,750 So, it won't be foolproof to find everything 74 74 00:02:48,750 --> 00:02:51,450 you're looking for inside a hibernation file. 75 75 00:02:51,450 --> 00:02:54,270 Now our fourth method is looking at the page file. 76 76 00:02:54,270 --> 00:02:56,550 Now, a page file is a file that stores pages 77 77 00:02:56,550 --> 00:02:59,063 of memory that were in use that exceed the capacity 78 78 00:02:59,063 --> 00:03:01,415 of the host's physical RAM modules. 79 79 00:03:01,415 --> 00:03:03,360 So let's say, you're using a little netbook 80 80 00:03:03,360 --> 00:03:05,490 and it only has four gigabytes of RAM. 81 81 00:03:05,490 --> 00:03:07,080 Well, on most window systems, 82 82 00:03:07,080 --> 00:03:08,970 that's pretty minimal these days. 83 83 00:03:08,970 --> 00:03:10,290 And so what'll end up happening is 84 84 00:03:10,290 --> 00:03:11,400 there'll be this page file 85 85 00:03:11,400 --> 00:03:13,830 or swap file on the computer, and 86 86 00:03:13,830 --> 00:03:16,011 as it needs to get things into an out of memory, 87 87 00:03:16,011 --> 00:03:19,650 it will go into this temporary memory, this page file 88 88 00:03:19,650 --> 00:03:21,840 and that's actually written on the hard drive. 89 89 00:03:21,840 --> 00:03:23,490 Now, this slows down the overall system 90 90 00:03:23,490 --> 00:03:26,190 which is something we cover in A plus, but for our purposes 91 91 00:03:26,190 --> 00:03:28,420 as digital forensic analysts, this is actually a good thing 92 92 00:03:28,420 --> 00:03:30,630 because that means, there's data that was written 93 93 00:03:30,630 --> 00:03:32,818 to the hard drive because when we turn off the computer, 94 94 00:03:32,818 --> 00:03:35,340 what's on the hard drive still stays there 95 95 00:03:35,340 --> 00:03:37,470 and so we can analyze that information. 96 96 00:03:37,470 --> 00:03:40,440 Now the bad thing is this is a page of memory at a time. 97 97 00:03:40,440 --> 00:03:41,327 It's not the whole thing 98 98 00:03:41,327 --> 00:03:43,500 and so it's going to look very random. 99 99 00:03:43,500 --> 00:03:45,276 So you're not going to be able to pull out entire files maybe 100 100 00:03:45,276 --> 00:03:47,026 but you can search for strings 101 101 00:03:47,026 --> 00:03:49,410 and try to find interesting things that may help you 102 102 00:03:49,410 --> 00:03:51,060 in your investigation. 103 103 00:03:51,060 --> 00:03:54,240 Alright, so that is our four methods that we can use. 104 104 00:03:54,240 --> 00:03:56,047 Now, again, when I'm talking about memory, 105 105 00:03:56,047 --> 00:03:58,650 I'm talking about RAM, and this is all something 106 106 00:03:58,650 --> 00:03:59,970 that's going to lose its content 107 107 00:03:59,970 --> 00:04:01,800 whenever you power off the system. 108 108 00:04:01,800 --> 00:04:03,556 And so you have to be able to capture that data 109 109 00:04:03,556 --> 00:04:06,687 and often, you'll capture it in multiple different ways 110 110 00:04:06,687 --> 00:04:08,996 as we went through these different options here. 111 111 00:04:08,996 --> 00:04:10,590 Now remember, even when you're dealing 112 112 00:04:10,590 --> 00:04:11,543 with a specialized tool, 113 113 00:04:11,543 --> 00:04:14,580 live acquisition will just generate a snapshot 114 114 00:04:14,580 --> 00:04:16,050 of the data that you're seeing. 115 115 00:04:16,050 --> 00:04:19,135 But remember, this data is changing second by second. 116 116 00:04:19,135 --> 00:04:20,575 RAM is very quick moving 117 117 00:04:20,575 --> 00:04:23,580 and that's why it's high-up on our order of volatility. 118 118 00:04:23,580 --> 00:04:26,310 But we want to do this very early in our collection cycle. 119 119 00:04:26,310 --> 00:04:27,480 Remember, if I have a computer 120 120 00:04:27,480 --> 00:04:29,460 and it's been sitting here for three hours, 121 121 00:04:29,460 --> 00:04:31,170 whatever was on the computer three hours ago 122 122 00:04:31,170 --> 00:04:33,150 in RAM may not be there anymore. 123 123 00:04:33,150 --> 00:04:33,983 It may be 124 124 00:04:33,983 --> 00:04:36,300 that whatever I did five minutes ago is not there either. 125 125 00:04:36,300 --> 00:04:37,770 The more your computer is in use, 126 126 00:04:37,770 --> 00:04:40,200 the more things are swapped in and out of RAM 127 127 00:04:40,200 --> 00:04:41,884 and that makes it even harder to collect. 128 128 00:04:41,884 --> 00:04:44,400 So, what kind of things can you expect to find 129 129 00:04:44,400 --> 00:04:46,903 when you start analyzing the image from memory? 130 130 00:04:46,903 --> 00:04:49,050 Well, there's lots of things you can find. 131 131 00:04:49,050 --> 00:04:50,250 You might be able to find a list 132 132 00:04:50,250 --> 00:04:52,950 of the running processes at the time of collection. 133 133 00:04:52,950 --> 00:04:55,380 You may find password hashes that could be useful. 134 134 00:04:55,380 --> 00:04:56,910 You might find cryptographic keys, 135 135 00:04:56,910 --> 00:04:58,844 which can help you unlock encrypted hard drives 136 136 00:04:58,844 --> 00:05:00,360 that you won't be able to access 137 137 00:05:00,360 --> 00:05:01,500 when you shut down the computer 138 138 00:05:01,500 --> 00:05:03,180 if you didn't have those keys. 139 139 00:05:03,180 --> 00:05:05,640 You might be able to find registry keys that were useful. 140 140 00:05:05,640 --> 00:05:06,860 You might find cached files 141 141 00:05:06,860 --> 00:05:09,480 and you might find strings from open files. 142 142 00:05:09,480 --> 00:05:11,100 All of these are things that are going to be useful 143 143 00:05:11,100 --> 00:05:13,200 to you as you're going through your analysis 144 144 00:05:13,200 --> 00:05:14,820 and going through your investigation. 145 145 00:05:14,820 --> 00:05:16,920 And so, it's important to collect that information 146 146 00:05:16,920 --> 00:05:19,670 by acquiring your memory image early on in the process.