Hey everyone welcome to our next section memory forensics in this section we're going to introduce the
most important concepts of virtual memory and memory forensics will introduce memory acquisition techniques
and tools and show a practical example of acquiring the target system RAM.
Finally we'll look at the bold Tildy framework and cover the analysis of a memory image.
Now we move on to the introduction to memory forensics.
We're going to take a look at memory forensics and the fundamental theory behind virtual memory management
and paging page files.
Hibernation files and crash stubs in the second video of our first section brief introduction to digital
forensics.
We saw that forensic evidence can be divided into two types volatile and nonvolatile.
So far we've covered the acquisition or imaging then the analysis of nonvolatile data and analyze volatile
data in this specific case.
RAM memory from live running systems memory forensics is still a field of development that has yet to
reach full maturity.
It's a fundamental part of the instant response investigation process.
For example after the detection of an intrusion or a malware infection in these situations it's very
important to acquire volatile data that otherwise could be lost when the system is shut down.
For instance a list of running system services and user processes currently loaded drivers and modules
even Network Connections routing and HRP tables.
All of this data can be collected using live response tools designed for the target system but can also
be recovered analyzing a memory image.
Furthermore evidence such as user's password and decrypted data encryption keys and memory resident
injected code fragments exist only in RAM for example advanced violence or memory only resident malware
does not create files on the disk so they can only be detected from the analysis of memory before diving
into memory acquisition and analysis.
It's important to recall how the main system memory is structured.
Modern operating systems use virtual memory to manage the main memory.
Virtual Memory is an abstraction that allows to overcome the size limits of the physical memory and
manages the mapping between logical to physical memory addresses.
Each process has its own private virtual address space which is divided into chunks called pages which
are mapped to page frames in physical memory.
The mapping between pages and page frames can be found in the page table.
The page table also keeps track whether pages are memory resident or not as we could see in this diagram.
When the entire virtual memory space is larger than the available physical memory pages are swapped
to the disk or a page file or a swap partition.
According to page replace the algorithm for example least recently used algorithm.
This way a larger number of processes could be resident in memory and run at a given time even at the
physical RAM is full.
When a process refers a virtual address belonging to a swopped page a page file is generated and the
memory reads the page from the disk and loads it in memory.
Updating the page table window swaps pages to the page file DOCSIS file located in the main system drive
while Unix and Linux use the swap partition analysis of the page file or the swap partition can be complemented
with that of the captured RAM to obtain a complete view of the entire virtual memory.
Another source of evidence is the hibernation file where an OS saves the full contents of RAM before
going into hibernation on Windows.
This file is high profile DOCSIS and it's located in the main system drive.
While Linux generally uses the Soie partitions but can also use a swap file sometimes crash dumps generated
by the OS when an application crashes.
Could be of interest to the forensic examiner.
They could be either full kernel memory dumps or small dumps that contain more limited sets of data.
Well done in this video we introduced the fundamental concepts of memory forensics and virtual memory.
In the next video we're going to see how to acquire a memory image with various acquisition methods
and tools and showed example of memory acquisition with wind penmen.