Digital Forensics Fundamentals

Memory forensics overview

Learning Outcome

A student solves a math problem on a whiteboard. The board contains all the calculations needed to solve the problem.

Whiteboard = RAM;

Calculations = Temporary Data

The student erases the whiteboard, and the calculations disappear. In the same way, RAM data is generally lost when the computer is powered off.

RAM = Volatile Memory

Memory Architecture Basics

Memory architecture describes how computer memory stores and organizes data while the system is running. RAM stores the operating system, applications, and active user data. It is fast but temporary, so its contents are usually lost when the computer is turned off.

Memory analysis can reveal running processes, network connections, encryption keys, and malware.

Volatile Data Concepts

Volatile data is information stored in memory that is lost when a system is powered off or restarted.

Volatile data may provide evidence that cannot be recovered from the disk.

Active network connections

Running processes

Logged-in users

Clipboard contents

Temporary passwords

Encryption keys

Examples include:

Live System Acquisition

Live system acquisition collects digital evidence while a computer is still running. It allows investigators to capture volatile data such as RAM, running applications, active users, and network sessions.

Because live acquisition can alter some data, investigators should use trusted tools and document all actions.

Memory Capture Techniques

Memory capture creates a copy of RAM, usually saved as a memory dump.

Proper capture preserves evidence that would otherwise be lost.

Using specialized memory acquisition software

Capturing memory before shutdown

Using trusted forensic tools

Saving the image to external storage

Common techniques include:

Memory Dump Formats

A memory dump is a file containing RAM contents at a specific time.

ELF Memory Format

Kernel Memory Dump

RAW Memory Dump

Complete Memory Dump

Crash Dump

These files are analyzed using forensic software.

Common formats include:

Process Enumeration

Process names

Process IDs (PID)

Parent-child relationships

Process start times

Resource usage

Process enumeration identifies active processes stored in memory.

Investigators examine:

This helps identify suspicious or unauthorized programs.

Active Network Session Analysis

Open Handles and Objects

Memory analysis can reveal active network connections while a computer is running.

Investigators may identify:

Connected IP addresses

Open ports

TCP/UDP connections

Remote servers

This helps determine whether the system communicated with suspicious devices.

This helps understand application activity.

An open handle is a reference used by a program to access system resources. Investigators examine handles to determine which resources were being accessed.

Examples include:

Open files

Registry keys

Running processes

Network sockets

Registry Data in Memory

Parts of the Windows Registry are loaded into memory while the system is running.

Investigators can analyze this data to identify:

User accounts

Recently opened files

Installed software

System configuration

Startup programs

Registry data helps reconstruct user activity and system settings.

User Activity Reconstruction

User activity reconstruction rebuilds user actions by analyzing memory data.

This helps determine what the user was doing when memory was captured.

Investigators may identify:

Logged-in users

Recently opened applications

Open documents

Browsing activity

Chat sessions

Clipboard contents

Malware Artifact Discovery

Memory analysis can reveal malware that operates in memory to avoid detection.

This helps determine what the user was doing when memory was captured.

Common artifacts include:

Malicious processes

Injected code

Suspicious DLLs

Unauthorized network connections

Hidden services

Code Injection Detection

Code injection occurs when malicious code is inserted into a legitimate process. Investigators examine processes for unusual memory regions, injected code, or modified behavior.

Detecting code injection helps identify sophisticated attacks.

Credential Artifact Analysis

Credential artifacts are traces of authentication information stored in memory.

These artifacts help determine who accessed the system and how authentication occurred.

Examples include:

Usernames

Password hashes

Login sessions

Security credentials

Authentication tokens

Memory timeline analysis arranges memory-related events chronologically to reconstruct system activity.

Memory Timeline Analysis

A timeline may include:

• Process creation
• User logins
• Network connections
• Application launches
• Malware execution

Threat Hunting in Memory

Memory threat hunting proactively searches RAM for malicious activity that traditional security tools may miss.

It helps detect advanced and fileless attacks.

Investigators look for:

Unknown processes

Suspicious DLLs

Hidden malware

Unauthorized network connections

Code injection

Rootkits

Memory Analysis Frameworks

Memory threat hunting proactively searches RAM for malicious activity that traditional security tools may miss.

They simplify investigations and improve analysis accuracy.

Key features include:

Process analysis

Network analysis

Registry analysis

Malware detection

Timeline generation

Memory Investigation Tools

Common memory forensic tools include:

Analyzes memory dumps for processes, malware, network connections, and registry data.

Analyzes memory images and detects malicious activity.

Captures memory from live systems and creates forensic images.

Captures RAM from running Windows systems.

Acquires RAM from live computers for forensic analysis.

Volatility Framework

Rekall

FTK Imager

Magnet RAM Capture

Belkasoft RAM Capturer

Summary

Quiz

Which type of memory loses its contents when the computer is turned off?

Quiz-Answer

C. RAM

Which type of memory loses its contents when the computer is turned off?