Narrator: Memory acquisition. 2 2
Now, as we go through our order of volatility, one 3 3
of the things we need to collect very early on 4 4
is our system memory. 5 5
That stuff that's stored inside of RAM. 6 6
The way we do this 7 7
is through system memory image acquisition. 8 8
This is a process that creates an image file 9 9
of the system memory that can be analyzed 10 10
to identify the processes that we're running 11 11
the contents of temporary file systems, registry data, 12 12
network connections, cryptographic keys, and much more. 13 13
Now, there are lots of different ways to do this 14 14
and we're going to talk 15 15
about the four most common categories in this lesson. 16 16
These four categories are live acquisition, crash dump, 17 17
hibernation files and page files. 18 18
First, live acquisition. 19 19
Now, live acquisition is the process 20 20
of capturing the contents 21 21
of memory while the computer is running 22 22
and you do this using specialist hardware or software tools. 23 23
Now, there are lots of different tools out there 24 24
but unfortunately, all of these tools 25 25
need to be pre-installed 26 26
because they need to have kernel mode drivers 27 27
to be able to function and get the data out of the system. 28 28
Now, there's lots of 'em out there 29 29
but the two that we are going to mention here are memoryze 30 30
from FireEye and F-Response for TACTICAL 31 31
Both of these are good tools that you can use 32 32
to be able to capture the memory contents, but again, 33 33
they need to be included as part 34 34
of your build for your workstations across your enterprise 35 35
so they're ready and waiting when you're ready to use them. 36 36
Now the second way you can capture the memory 37 37
is by performing a crash dump. 38 38
Now essentially, a crash dump is when the contents 39 39
of memory are written to a dump file 40 40
when windows encounter some kind 41 41
of unrecoverable kernel error. 42 42
These days, most modern computers have a lot of memory. 43 43
If you look at your standard computer nowadays, 44 44
they have eight gigabytes 45 45
or 16 gigabytes or 32 gigabytes of RAM. 46 46
Now when you have a crash dump happen, 47 47
it doesn't have time to write all of that to the disc. 48 48
So instead, you'll usually get the results 49 49
in a mini dump file. 50 50
This may contain some valuable information 51 51
and potential evidence, but it won't be a full-copy 52 52
of the memory because there's just simply not enough time 53 53
to write all of that to disk before the system crashes. 54 54
The third method we have is known as the hibernation file. 55 55
Now, on every computer, there is a file that will be written 56 56
to disk whenever the workstation is put 57 57
into a sleep state. 58 58
This is known as the hibernation file. 59 59
Essentially, if you take your laptop and you shut the lid, 60 60
it creates this hibernation file so that when you open 61 61
the lid again and you turn on the computer, 62 62
it can wake up and go right back to what it was doing. 63 63
Now that hibernation file can be read 64 64
and analyzed using different forensic tools 65 65
and this will allow you to go through that 66 66
and find any information that may have been written there. 67 67
Now this is a great way to get information 68 68
but there are some drawbacks too. 69 69
If you're trying to hunt for malware. 70 70
Some types of malware can actually detect the use 71 71
of a sleep state, and because of that, 72 72
they'll perform any forensics to try to hide their activity. 73 73
So, it won't be foolproof to find everything 74 74
you're looking for inside a hibernation file. 75 75
Now our fourth method is looking at the page file. 76 76
Now, a page file is a file that stores pages 77 77
of memory that were in use that exceed the capacity 78 78
of the host's physical RAM modules. 79 79
So let's say, you're using a little netbook 80 80
and it only has four gigabytes of RAM. 81 81
Well, on most window systems, 82 82
that's pretty minimal these days. 83 83
And so what'll end up happening is 84 84
there'll be this page file 85 85
or swap file on the computer, and 86 86
as it needs to get things into an out of memory, 87 87
it will go into this temporary memory, this page file 88 88
and that's actually written on the hard drive. 89 89
Now, this slows down the overall system 90 90
which is something we cover in A plus, but for our purposes 91 91
as digital forensic analysts, this is actually a good thing 92 92
because that means, there's data that was written 93 93
to the hard drive because when we turn off the computer, 94 94
what's on the hard drive still stays there 95 95
and so we can analyze that information. 96 96
Now the bad thing is this is a page of memory at a time. 97 97
It's not the whole thing 98 98
and so it's going to look very random. 99 99
So you're not going to be able to pull out entire files maybe 100 100
but you can search for strings 101 101
and try to find interesting things that may help you 102 102
in your investigation. 103 103
Alright, so that is our four methods that we can use. 104 104
Now, again, when I'm talking about memory, 105 105
I'm talking about RAM, and this is all something 106 106
that's going to lose its content 107 107
whenever you power off the system. 108 108
And so you have to be able to capture that data 109 109
and often, you'll capture it in multiple different ways 110 110
as we went through these different options here. 111 111
Now remember, even when you're dealing 112 112
with a specialized tool, 113 113
live acquisition will just generate a snapshot 114 114
of the data that you're seeing. 115 115
But remember, this data is changing second by second. 116 116
RAM is very quick moving 117 117
and that's why it's high-up on our order of volatility. 118 118
But we want to do this very early in our collection cycle. 119 119
Remember, if I have a computer 120 120
and it's been sitting here for three hours, 121 121
whatever was on the computer three hours ago 122 122
in RAM may not be there anymore. 123 123
It may be 124 124
that whatever I did five minutes ago is not there either. 125 125
The more your computer is in use, 126 126
the more things are swapped in and out of RAM 127 127
and that makes it even harder to collect. 128 128
So, what kind of things can you expect to find 129 129
when you start analyzing the image from memory? 130 130
Well, there's lots of things you can find. 131 131
You might be able to find a list 132 132
of the running processes at the time of collection. 133 133
You may find password hashes that could be useful. 134 134
You might find cryptographic keys, 135 135
which can help you unlock encrypted hard drives 136 136
that you won't be able to access 137 137
when you shut down the computer 138 138
if you didn't have those keys. 139 139
You might be able to find registry keys that were useful. 140 140
You might find cached files 141 141
and you might find strings from open files. 142 142
All of these are things that are going to be useful 143 143
to you as you're going through your analysis 144 144
and going through your investigation. 145 145
And so, it's important to collect that information 146 146
by acquiring your memory image early on in the process.