Digital Forensics Fundamentals

Memory forensics overview

Learning Outcome

Differentiate SOC team roles and responsibilities.

Identify SOC components: People, Processes, and Technology.

Describe SOC functions: monitoring, detection, investigation, and response.

Explain the purpose and importance of a SOC.

Recognize common SOC tools: SIEM, IDS/IPS, EDR, and Firewalls.

A student solves a math problem on a whiteboard. The board contains all the calculations needed to solve the problem.

Whiteboard = RAM;

Calculations = Temporary Data

While working, the student keeps notes about the current problem. Similarly, RAM stores running programs, open applications, active websites, logged-in users, and network connections.

RAM stores volatile data currently being used by the system.

The student erases the whiteboard, and the calculations disappear. In the same way, RAM data is generally lost when the computer is powered off.

RAM = Volatile Memory

Before erasing the board, someone takes a photo of it to preserve the calculations. Similarly, investigators capture a memory dump before important RAM data is lost.

Collecting and analyzing RAM data = Memory Forensics

Memory architecture describes how computer memory stores and organizes data while the system is running. RAM stores the operating system, applications, and active user data. It is fast but temporary, so its contents are usually lost when the computer is turned off.

Memory analysis can reveal running processes, network connections, encryption keys, and malware.

Volatile Data Concepts

Volatile data is information stored in memory that is lost when a system is powered off or restarted.

Volatile data may provide evidence that cannot be recovered from the disk.

Active network connections

Running processes

Logged-in users

Clipboard contents

Temporary passwords

Encryption keys

Examples include:

Live System Acquisition

Live system acquisition collects digital evidence while a computer is still running. It allows investigators to capture volatile data such as RAM, running applications, active users, and network sessions.

Because live acquisition can alter some data, investigators should use trusted tools and document all actions.

Memory Capture Techniques

Memory capture creates a copy of RAM, usually saved as a memory dump.

Proper capture preserves evidence that would otherwise be lost.

Using specialized memory acquisition software

Capturing memory before shutdown

Using trusted forensic tools

Saving the image to external storage

Common techniques include:

Memory Dump Formats

A memory dump is a file containing RAM contents at a specific time.

ELF Memory Format

Kernel Memory Dump

RAW Memory Dump

Complete Memory Dump

Crash Dump

These files are analyzed using forensic software.

Common formats include:

Process Enumeration

Process names

Process IDs (PID)

Parent-child relationships

Process start times

Resource usage

Process enumeration identifies active processes stored in memory.

Investigators examine:

This helps identify suspicious or unauthorized programs.

Service and Application Analysis

Running applications

Background services

Startup programs

Suspicious software

Unauthorized applications

Investigators examine running services and applications to identify normal and suspicious activity.

Analysis may include:

This can reveal malicious or unauthorized programs active during an incident.

Active Network Session Analysis

Open Handles and Objects

Memory analysis can reveal active network connections while a computer is running.

Investigators may identify:

Connected IP addresses

Open ports

TCP/UDP connections

Remote servers

This helps determine whether the system communicated with suspicious devices.

This helps understand application activity.

An open handle is a reference used by a program to access system resources. Investigators examine handles to determine which resources were being accessed.

Examples include:

Open files

Registry keys

Running processes

Network sockets

Registry Data in Memory

Parts of the Windows Registry are loaded into memory while the system is running.

Investigators can analyze this data to identify:

User accounts

Recently opened files

Installed software

System configuration

Startup programs

Registry data helps reconstruct user activity and system settings.

User Activity Reconstruction

User activity reconstruction rebuilds user actions by analyzing memory data.

This helps determine what the user was doing when memory was captured.

Investigators may identify:

Logged-in users

Recently opened applications

Open documents

Browsing activity

Chat sessions

Clipboard contents

Malware Artifact Discovery

Memory analysis can reveal malware that operates in memory to avoid detection.

This helps determine what the user was doing when memory was captured.

Common artifacts include:

Malicious processes

Injected code

Suspicious DLLs

Unauthorized network connections

Hidden services

Code Injection Detection

Code injection occurs when malicious code is inserted into a legitimate process. Investigators examine processes for unusual memory regions, injected code, or modified behavior.

Detecting code injection helps identify sophisticated attacks.

This helps identify rootkit activity.

Hidden processes

Concealed drivers

Unauthorized system modifications

Rootkit Identification

A rootkit is malware designed to hide itself or other malicious software.

Memory analysis can reveal:

Credential Artifact Analysis

Credential artifacts are traces of authentication information stored in memory.

These artifacts help determine who accessed the system and how authentication occurred.

Examples include:

Usernames

Password hashes

Security credentials

Authentication tokens

Memory timeline analysis arranges memory-related events chronologically to reconstruct system activity.

Memory Timeline Analysis

A timeline may include:

Process creation
User logins
Network connections
Application launches
Malware execution

Memory parsing extracts useful information from memory dumps using forensic tools.

Memory Parsing Techniques

Investigators parse memory to identify:

Running processes
Active users
Network sessions
Registry information
Loaded modules

Threat Hunting in Memory

Memory threat hunting proactively searches RAM for malicious activity that traditional security tools may miss.

It helps detect advanced and fileless attacks.

Investigators look for:

Unknown processes

Suspicious DLLs

Hidden malware

Unauthorized network connections

Code injection

Rootkits

Memory Analysis Frameworks

Memory threat hunting proactively searches RAM for malicious activity that traditional security tools may miss.

They simplify investigations and improve analysis accuracy.

Key features include:

Process analysis

Network analysis

Registry analysis

Malware detection

Timeline generation

Memory Investigation Tools

Common memory forensic tools include:

Analyzes memory dumps for processes, malware, network connections, and registry data.

Analyzes memory images and detects malicious activity.

Captures memory from live systems and creates forensic images.

Captures RAM from running Windows systems.

Acquires RAM from live computers for forensic analysis.

Volatility Framework

Rekall

FTK Imager

Magnet RAM Capture

Belkasoft RAM Capturer

Summary

RAM contains valuable evidence.

Tools include Volatility, FTK Imager, and Magnet RAM Capture.

Memory acquisition creates a copy of RAM for analysis.

RAM is volatile and loses data when powered off.

Memory forensics analyzes data in RAM.

Quiz

Which type of memory loses its contents when the computer is turned off?

B. Hard Disk Drive

C. RAM

D. USB Flash Drive

A. SSD

Quiz-Answer

C. RAM

Which type of memory loses its contents when the computer is turned off?

A. SSD

B. Hard Disk Drive

D. USB Flash Drive