Memory Acquisition

Memory Analysis | Part 2

Before you can analyze memory, you have to grab it. And I don’t mean politely asking the system for a cup of RAM. Memory acquisition is the act of copying the volatile, fleeting contents of a system’s RAM to a safe, non-volatile storage for later forensic dissection. The quality of your memory analysis isn’t determined by fancy tools or long scripts — it hinges on how well you capture memory. A bad dump is worse than no dump at all.

Get Iram Jack’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

In this session, we’ll dissect all the variables you need to obsess over before, during, and after memory acquisition. Think of this as your blueprint to forensically sound memory captures on Windows, Linux, and hypervisors alike. Buckle up.

Techniques, Tools, and Best Practices

Memory acquisition doesn’t start the second you hit “run” on a memory dump tool. It starts long before that, in the quiet, calculated decisions documented in your incident response plan. Your plan should answer:

• Which acquisition techniques are worth your time?
• Which tools will actually deliver usable evidence?
• When should you pull the trigger?
• Which slice of memory matters most?
• How will you ensure integrity?

This part is all about those crucial choices.

Selecting the Right Memory Part

Not all memory is created equal. Before acquisition, decide what part of memory actually matters. This is case-dependent, shaped by the IOAs and IOCs you’ve observed. Some examples:

• Unusual resource usage: That innocent-looking process is chewing up CPU and RAM like there’s no tomorrow. Grab a process dump, not the entire memory — full dumps are slow and noisy.
• Malware infection: Firewall logs scream “active C2.” Time for a full memory capture. Leave no ghost behind.
• System shutdown: Signs of fraud, but the user is on lunch break. The machine is powered off, yet the hiberfil.sys file gives you a backdoor to memory content. Smooth.

Here’s a quick overview of memory capture types and their forensic value. Remember: pagefile, hibernation files, and VM memory files aren’t true memory — they’re snapshots after actions, filled with residual artifacts.

In upcoming session, we’ll get our hands dirty with these captures on Windows and Linux.

Choosing the Appropriate File Format

Memory images are like cocktails — pick the right one for the right occasion. There’s no global standard, so choose a format compatible with your analysis tool:

• .raw / .mem — Raw, unadulterated physical memory. Works across macOS, Windows, Linux. Best for broad compatibility.
• .dmp — Windows’ built-in memory dump. Needs configuring first; we’ll explore this in ‘Memory acquisition for Windows’.
• VM formats (.vmem, .vmsn, .vmss, .bin, .sav) — Snapshots or suspended VM states. Remember to convert .sav for analysis.
• .core — Process-level dump on Linux, ELF format. Also appears when a process crashes.
• Expert Witness Format — Encase’s gold-standard forensic capture. Advanced, pricey, respected.
• .lime — Structured full memory dump via LiME (Linux Memory Extractor). Linux enthusiasts rejoice.

Choosing the Acquisition Technique

There’s no one-size-fits-all. Pick based on your situation:

• Local — Plug in external storage and dump memory. Physical access required.
• Remote — Dump memory over the network. Ideal for inaccessible systems or remote servers.
• Hardware — Dedicated PCIe card. Costly, but avoids OS-level interference.
• RAM freezing — Literally freeze RAM to preserve volatile contents. Then move it to a dedicated system for dumping. Science fiction? Almost.

Important caveats:

• Admin privileges are a must for full memory access.
• Remote transfers can compromise the receiving system — malware loves moving laterally.
• Local storage might get contaminated. Disposable systems, people.
• Hardware cards are expensive. Make sure your budget isn’t crying more than your evidence.

Tools: Choose Wisely

The tool is only as good as your plan. Consider:

• Integrity
• Compatibility
• Speed & scalability
• Compliance
• Cost
• Forensic noise introduced

No single tool solves all problems. Pick wisely, or you’ll waste hours for nothing but corrupted evidence.

Timing Your Memory Capture

Timing isn’t just important — it’s everything. RAM is a living, changing entity. Capture at the wrong moment and you’ll get ghosts, lies, and lost evidence. Consider:

• Lateral movement: Snag memory while attackers are hopping hosts. Your dump now contains remote sessions and compromised creds. Jackpot.
• Fileless malware: Quick capture = find PowerShell scripts, C2 IPs, and payloads before they vanish.
• Evidence destruction: Wait too long, and rebooting users destroy your chance to capture exfiltration traces.

Other reminders:

• Malware doesn’t sleep — it works nights, weekends, holidays.
• Avoid bootup, scans, backups — memory changes fast then.

Now you know the essential considerations for memory acquisition. These aren’t suggestions — they are your checklist every time you touch RAM. In the next parts, your decisions will answer:

• What part of memory do I need?
• Which tool or technique will I use?
• When should I capture it?
• How do I ensure integrity?