Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 36 guests online
 
Free Business and Tech Magazines and eBooks

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Forensicsarrow Dumping memory and browsing through it
EH-Net
May 21, 2013, 04:56:25 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Dumping memory and browsing through it  (Read 6206 times)
0 Members and 1 Guest are viewing this topic.
kamikaze_fish
Newbie
*
Offline Offline

Posts: 2


View Profile
« on: June 08, 2011, 12:06:14 PM »

I'm new to computer forensics but I'm trying to figure out how to dump the data in the physical memory, maybe to a flash drive, and what can I use to browse that dump?  I was looking at win32dd and win64dd and possibly using volitility to browse the contents but not sure if there's something better to use or would someone can point me to training material
Logged
sil
Hero Member
*****
Offline Offline

Posts: 549



View Profile WWW
« Reply #1 on: June 08, 2011, 12:52:05 PM »

If you're a glutton for punishment, Mandiant Memorize + WinDBG will get you ALL you will need (http://www.mandiant.com/products/free_software/memoryze/)

Volatility works just fine without the hassles of getting your hands really dirty as well. WMFT is alright as well but any of the ones mentioned should get you started and finished.

http://www.mandiant.com/products/free_software/memoryze/
http://forensic.seccure.net/tools/wmft_0.2.zip
Logged

sil
Hero Member
*****
Offline Offline

Posts: 549



View Profile WWW
« Reply #2 on: June 08, 2011, 04:23:45 PM »

You could also use DFF see 2 minute video walkthrough

http://www.infiltrated.net/dff-walkthrough/
Logged

R3B005t
Newbie
*
Offline Offline

Posts: 43


View Profile
« Reply #3 on: June 10, 2011, 01:36:07 PM »

Sil what are you thoughts on DFF? I'm playing around with it and find it to be pretty robust so far, I'd recommend kamikaze go for the Mandiant Memorize and the Memorize viewer initally till he gets more comfortable with the more advanced memory forensic tools.  There really is no end to memory analysis kit out there, if your comfortable with nix then you could play around with the sans sift workstation....

Actually Mandiant put out a new memory analysis tool called Redline, I have yet to play with it (dling now) but it might be worth looking into, overall I think the make a decent product.  So to recap Memoryze & Audit Viewer, or Redline would be great starting points.
« Last Edit: June 10, 2011, 01:41:24 PM by R3B005t » Logged
sil
Hero Member
*****
Offline Offline

Posts: 549



View Profile WWW
« Reply #4 on: June 10, 2011, 01:56:11 PM »

DFF is alright, nothing more than a GUI for most other tools. I like to use old school *nix tools via cli most of the times. I can do so from anywhere and the results are the same. It also helps keeping me on my toes via way remembering things.
Logged

kamikaze_fish
Newbie
*
Offline Offline

Posts: 2


View Profile
« Reply #5 on: June 10, 2011, 02:48:35 PM »

Thank you Sil.  Great information and you've definitely given me a god start.
Logged
nebu10uz
Sr. Member
****
Offline Offline

Posts: 368



View Profile WWW
« Reply #6 on: June 10, 2011, 03:20:53 PM »


Yeah, I like Memorize and you can make it portable too. I added it to my Iron Key USB flash drive as part of my tool kit. You just have to make sure to run it once from your flash drive with write-mode enable to let it copy some additional files.

Also, last week I had the chance to play around with Redline. I like it except that you need .Net Framework version 4 or greater to use it on your Windows machine. Currently, it's very slow in analyzing memory dumps and it doesn't work well with Windows 7. But hey, it's new and I'm sure that Mandiant will improve it and make it better. I do recommend for beginners to take look at Redline and use it because it walks you through with explaination on quickly detecting suspicious or potentially malicious processes and etc.   

Btw, Don, I can't thank you enough for the Iron Key flash drive. I can't live without it! Since I can unlock the Iron Key in read-mode only, it's perfect for incident response and malware forensic. You don't have to worry about your flash drive getting infected. I know it has been more than a year that I received my Iron Key, but I just wanted to say thanks again.
Logged

Security+, OSCP, CEH
R3B005t
Newbie
*
Offline Offline

Posts: 43


View Profile
« Reply #7 on: June 12, 2011, 02:10:28 PM »

Yeah redline has potential I hate the .net requirement and keep in mind this is the first release of the product.. Things I have on my Ironkey-Sysinternals suite, mir standalone scan (we do have an appliance but you never know when you need to do the odd offline capture) I tossed redline on there as well as a few other custom goodies.  Only beef I have with the iron key is that its a thousand times bigger than any other memory key I have.  Over all though the product roxxs.
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.058 seconds with 22 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.