Cyberstudy
PDF p.311 In progress

System Memory Acquisition

Open PDF at p.311 10 flashcards

Summary

PDF p.311

System memory acquisition involves creating a dump of volatile data held in RAM. This data can be analyzed to identify running processes, temporary file contents, registry data, network connections, cryptographic keys, and more. Specialized tools are required for this process.

In plain words

Supplementary — not from your PDF

A memory dump captures RAM, which shows running processes, temporary data, registry keys that exist only in memory, network connections, and even encryption keys, all of which are lost at power-off. Memory acquisition tools usually need a kernel-mode driver, so they're best preinstalled. On Linux, the Volatility framework includes a driver-based acquisition tool.

Detailed explanation

PDF p.311

Volatile Data

  • Definition: Data held in RAM, lost when power is removed.
  • Purpose: Analyzing a memory dump can reveal running processes, temporary file systems, registry data, network connections, cryptographic keys, and encrypted data.

Acquisition Tools

  • Specialist Tools: Hardware or software tools that capture memory contents while the host is running.
  • Preinstallation: Tools need to be preinstalled as they require a kernel mode driver.
  • Commercial Tools: Available for Windows to perform system memory acquisition.
  • Linux Tools: The Volatility framework includes a tool to install a kernel driver for memory acquisition.

Important terms

taken from the text above
Specialist Tools
Hardware or software tools that capture memory contents while the host is running.
Preinstallation
Tools need to be preinstalled as they require a kernel mode driver.
Commercial Tools
Available for Windows to perform system memory acquisition.
Linux Tools
The Volatility framework includes a tool to install a kernel driver for memory acquisition.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Capturing RAM from a live server during an investigation.
  • Finding an encryption key in a memory dump.
  • Volatility analyzing process lists from a dump.

Scenario

Disk-encrypted laptops can't be read after power-off. Capturing memory while the laptop is running can preserve keys and running processes that would otherwise be lost.

Common mistakes

Supplementary — not from your PDF
  • Assuming memory tools can always be installed during an incident. They often need preinstalled drivers.
  • Forgetting some registry keys exist only in memory.

Practical skills

Supplementary — not from your PDF
  • Explain what evidence a memory dump can provide.

What I should remember

Key Points PDF p.311
  • Volatile Data
    • Definition: Data in RAM, lost without power.
    • Purpose: Analyzing memory dumps for various data types.
  • Acquisition Tools
    • Specialist Tools: Capture memory contents.
    • Preinstallation: Requires kernel mode driver.
    • Commercial Tools: Available for Windows.
    • Linux Tools: Volatility framework for kernel driver installation.