Hey Guys welcome to memory acquisition.
We're going to take a look at the memory acquisition techniques and tools and show how to acquire a
ram image with Wimpey meme memory acquisition is the process of acquiring an image of the main memory
of a running system.
It can be done via hardware or software.
The former generally uses PCI Express or Firewire devices with firewire being limited to access only
the lower four gigabytes of system memory software based acquisition works by loading a kernel driver
that's able to read the entire physical memory and copy to a secondary nonvolatile storage memory acquisition
tools are loaded on the target system RAM and they should leave minimal footprint on it.
In other words occupy the minimal amount RAM space possible CLID tools are therefore generally preferable
to use as they need less memory to run software acquisition could be performed locally running the acquisition
tool on the target and dumping memory to an external drive or remotely.
The latter implies copying the tool on the target and running it and sending back the memory dump to
the forensic workstation through netcat or S-sh software acquisition tools are dependent on the US type.
Sometimes also on version running on the target system.
While the majority of these tools are commercial and developer windows there are few free tools that
are also available on Linux like FTA and Major and PM another tool that's available on Linux is lime
or Linux memory extractor.
It requires to be compiled from source for the exact kernel version of the subject system.
We're going to cover P meme which is part of the recall memory analysis framework.
A fork of the volatile project.
The Pieman suite offers a complete memory acquisition solution and as opposed to three acquisition tools.
OSX PNM wimpy mehm And Linde PM and the kernel memory drivers for the respective operating systems Team-EM
saves the output memory image in the advanced forensic format for format.
These tools can be downloaded from this page.
Note that with the latest releases of recall HTP colon slash slash releases don't recall Dasch frenzy
dot com.
Note that with the latest releases of recall these tools have been integrated with the framework we
have to choose version 1.6 point to because it allows to write the output of the SDD out and piping
it to tools like netcat or S-sh to send over the network.
We show a scenario where we have to perform a ram acquisition from a remote system.
In this case we emulate with a virtual machine running Windows 7 64 bit.
We assume that the network on the VM is configured as host only network and that when p.m.-I netcat
binary are already copied on the target system on the Linux workstation we execute netcat in listening
mode with the command.
This command instructs netcat to listen on port ninety nine ninety nine and write all the data received
from the netcat client on the target machine to an output image file.
In this case when seven men on the target machine we execute wimpy men and pipe the output to netcat
that connects to the port ninety nine ninety nine of the Kalli Linux host.
We specify the standard format of the output.
In this RA we must specify SDD out.
Note that when Pieman always requires the output option.
In this case it's the standard output.
We pipe the output to netcat specifying the IP address of the Linux host and the port.
Run this command and wait until next QCA completes when the execution of when Pieman on the target terminates
netcat also closes the connection and exits.
Let's check that the output memory image has been saved to the specified file.
In this case when seven men and the size is five hundred megabytes of the target system RAM.
OK in this video we introduced memory acquisition techniques and tools and showed a practical example
of acquiring a memory image with wimpy men.
Next we're going to introduce the volatility memory analysis framework.