How to accumulate information from the volatile data | Memory Forensic?
Hey there!! It’s me back again with the new blog. Today in this blog, I’m going to share with you some interesting stuff. Today, I will write a write-up about how I accumulated information from the volatile data.
If you’re ready, let’s get started with our task.
The Commence:
For this task, we have taken a sample of the memory image and to analyze the memory image firstly, we have to download the memory image which is in the form of a link as shown in the below screenshot.
At first, I downloaded the volatility tool for Linux through the Volatility Foundation” website. Then, I downloaded the memory image with the help of the given link, and after downloading the memory image I extracted the unzip file with the help of the command “unzip xp-laptop-2005–07–04–1430.zip” as shown in the below figure.
Volatility: Volatility is an open-source memory forensics framework for malware analysis and incident response. Volatility is the most popular memory forensics platform in the world. One of the largest and most active communities in the forensics field is behind the project. Volatility also offers a one-of-a-kind platform that allows cutting-edge research to be quickly transferred to digital investigators. As a result, Volatility has been used in some of the most important investigations in the last ten years.
Sample of the memory image
In the above Screenshot folder named “volatility_2.6” contains a sample of a memory image named “xp-laptop-2005–07–04–1430.img.”
After extracting the unzip file at first, I found out the type of image or in particular to know about the profile by examining the sample memory image with the help of the plugin name “imageinfo.”
1. Image info
2. Pslist
The next thing is to see what was going on when the memory dump was taken. Another plugin, pslist, can help us here.
This will bring up a list of processes that were running, and if we look at the time stamps, then it shows that the machine has just been switched on.
Users on the system
Get Rohit Ray’s stories in your inbox
Join Medium for free to get updates from this writer.
With the help of the “hashdump” plugin, I have found the users on the system as shown in the below figure. There are a total of seven users on the system which are Administrator, Guest, HelpAssistant, SUPPORT_388945a0, Phoenix, ASPNET and last one is Sarah.
AV on the machine
With the help of the “timeliner” plugin, I have found the Antivirus on the machine as shown in the below figure. The Antivirus that is on the machine is Symantec Antivirus.
Network connection
With the help of the “sockets” plugin, I found the listening socket connections during the time our memory dump was taken. These include TCP as well as UDP connections.
The last user logged into the system
With the help of the “hashdump” plugin, I have found the users on the system who was the last one logged into the system as shown in the below figure. The last user logged on the system is “Sarah.”
Final Reflections:
Accumulating information from the volatile data by taking a sample of the memory image and analyzing the memory image with the help of the “Volatility” tool was a great experience. With the Volatility tool, we could manage to get some sensitive data i.e. users on the system, network connections, type of antivirus, and many more things as we can see in the above figures. I hope you enjoyed it and learned new techniques.
That’s all for this blog, I hope you guys enjoyed this form of learning. ❤
Till then keep learning, keep exploring, and do hacking………………………
You can follow me on Social Media:
Linkedin: https://www.linkedin.com/in/rohit-ray-19284b232/
GitHub: https://github.com/rohit273
Twitter: https://twitter.com/RHittttt
Instagram: https://www.instagram.com/ro_hit.exe/
Please follow and subscribe for more awesome upcoming blogs.
