Module 5 - Volatile Data

Question 1

Types of data that may exist in memory that may not be on hard drive (5):

Answer 1

encryption keys
passwords
malware
registry
RAM disk

Question 2

Memory retention

Answer 2

After system is rebooted (not shutdown), data still resides in memory from the first instance until new values are sent to the register.

Question 3

Benefits of Memory Collection

Answer 3

• may have data not elsewhere on hard drive

- much data in unprotected,unencrypted format.

Question 4

Memory file on disk (list some)

Answer 4

swap files/page files
hibernation files
.vmem files

Question 5

Memory Capture / Analysis Tools (Name 5)

Answer 5

WindowScope
Volatility
Windows Memory Forensic Toolkit (WMFT)
Forensic Analysis Toolkit (FATKit)
Mandiant's Memoryze

Question 6

Describe Windows Memory Forensic Toolkit (WMFT)

Answer 6

• Collection of utilities intended for forensic use.

- Perform forensic analysis of physical memory images acquired from Windows 2000/2003/XP machines.

Question 7

Describe Forensic Analysis Toolkit (FATKit)

Answer 7

Cross-platform, modular, and extensible digital investigation framework for analyzing volatile system memory

Question 8

Describe WindowScope

Answer 8

• subsidiary of BlueRISC
• GUI, student versions
• Advanced analysis of running memory and image files
  Structure of memory
  Program calls

Question 9

Describe Volatility

Answer 9

• Volatile systems
• Multiple formats/types (Python Scripts, Compiled exe)
• Command Line
• 64 bit versions under development (info dated)
• version 2.0 (info dated)

Question 10

Name Some Artifacts retrieved with Volatility (7)

Answer 10

Image Identification: Which version of Windows was running
Lists of Processes and Loaded DLLs
Process Memory
Kernel Memory and Related Objects
Network Information, including open connections and sockets
Registry information, including hash dumps
Malware information

Question 11

Volatility command to obtain connections

Answer 11

volatility.exe -f .vmem connections
python vol.py -f .vmem connections

returns along with Process IDs (Pid)

Question 12

Volatility command to obtain open sockets

Answer 12

volatility.exe -f .vmem –profile=WinXPSP3x86 sockets

python vol.py -f .vmem –profile=WinXPSP3x86 sockets

Question 13

Volatility commands to obtain hash values of user accounts in memory

Answer 13

volatility. exe -f .vmem hivelist

volatility. exe -f .vmem hashdump -y -s

Question 14

Describe Memoryze

Answer 14

Created by Mandiant
Works with:
Windows 2000 Service Pack 4 (32-bit)
Windows XP Service Pack 2 and Service Pack 3 (32-bit)
Windows Vista Service Pack 1 and Service Pack 2 (32-bit)
Windows 2003 Service Pack 2 (32-bit)
Windows 2003 Service Pack 2 (64-bit)
Windows 7 Service Pack 0 (32-bit)
Windows 7 Service Pack 0 (64-bit)
*Windows 2008 Service Pack 1 and Service Pack 2 (32-bit) – beta version
Windows 2008 R2 Service Pack 0 (64-bit)