Skip to content

A curated list of awesome Memory Forensics for DFIR

License

Notifications You must be signed in to change notification settings

digitalisx/awesome-memory-forensics

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

88 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Awesome Memory Forensics Awesome

A curated list of awesome Memory Forensics for DFIR.

Memory Forensics is forensic analysis of a computer's memory dump. Its primary application is investigation of advanced computer attacks which are stealthy enough to avoid leaving data on the computer's hard drive. Consequently, the memory (RAM) must be analyzed for forensic information.

If you want to contribute, please read the contribution guidelines.

Contents

Tool

Memory Acquisition

Introduce commercial and open source tools for memory acquisition.

Software

  • Surge - Volexity's Surge Collect offers flexible storage options and an intuitive interface that any responder can run to eliminate the issues associated with the corrupt data samples, crashed target computers, and ultimately, unusable data that commonly results from using other tools.
  • MAGNET RAM - MAGNET RAM Capture is a free imaging tool designed to capture the physical memory of a suspect's computer, allowing investigators to recover and analyze valuable artifacts that are often only found in memory.
  • FTK Imager - FTK® Imager is a data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis with a forensic tool such as Forensic Toolkit (FTK®) is warranted.
  • Winpmem - WinPmem has been the default open source memory acquisition driver for windows for a long time.
  • Ram Capturer - Belkasoft Live RAM Capturer is a tiny free forensic tool that allows to reliably extract the entire contents of computer's volatile memory—even if protected by an active anti-debugging or anti-dumping system.
  • LiME - A Loadable Kernel Module (LKM) which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android.
  • AVML - AVML is an X86_64 userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary.
  • fmem - This module creates /dev/fmem device, that can be used for dumping physical memory, without limits of /dev/mem (1MB/1GB, depending on distribution).
  • FEX Memory Imager - FEX Memory Imager (FEX Memory) is a free imaging tool designed to capture the physical Random Access Memory (RAM) of a suspect's running computer. This allows investigators to recover and analyze valuable artifacts found only in memory.
  • MacQuisition
  • Digital Collector - A powerful forensic imaging software solution to perform triage, live data acquisition and targeted data collection for Windows and Mac computers.
  • varc - Volatile Artifact Collector gathers a snapshot of volatile data from a system.

Hardware

  • PCILeech - PCILeech uses PCIe hardware devices to read and write target system memory. This is achieved by using DMA over PCIe. No drivers are needed on the target system.

Misc

  • EVTXtract - EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.
  • Volatility3 Inodes Plugin - The plugin is a pushed verion of the lsof plugin extracting inode metadata information from each files.
  • Volatility3 Prefetch Plugin - The plugin is scanning, extracting and parsing Windows Prefetch files from Windows XP to Windows 11.

Memory Analysis

Introduce commercial and open source tools for memory analysis.

  • Volcano - A comprehensive, cross-platform, next- generation memory analysis solution, Volexity Volcano Professional's powerful core extracts, indexes, and correlates artifacts to provide unprecedented visibility into systems' runtime state and trustworthiness.
  • Volatility3 - Volatility is the world's most widely used framework for extracting digital artifacts from volatile memory (RAM) samples.
  • MemProcFS - The Memory Process File System (MemProcFS) is an easy and convenient way of viewing physical memory as files in a virtual file system.
  • WinDbg - The Windows Debugger (WinDbg) can be used to debug kernel-mode and user-mode code, analyze crash dumps, and examine the CPU registers while the code executes.
  • Volatility - The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
  • Volafox - macOS Memory Analysis Toolkit' is developed on Python 2.x (Deprecated)
  • Rekall - A new branch within the Volatility project was created to explore how to make the code base more modular, improve performance, and increase usability. (Deprecated)
  • Redline - Redline®, FireEye's premier free endpoint security tool, provides host investigative capabilities to users to find signs of malicious activity through memory and file analysis and the development of a threat assessment profile.
  • Memoryze - Mandiant's Memoryze™ is free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images and on live systems can include the paging file in its analysis.
  • dwarf2json - Go utility that processes files containing symbol and type information to generate Volatilty3 Intermediate Symbol File (ISF) JSON output suitable for Linux and macOS analysis.

Books

Course

Videos

13 Cubed

DFIR Science

Black Hat 2022

Black Hat 2019

Black Hat 2012

SANS Digital Forensics and Incident Response

ETC

Articles

JPCERT

Blogs

CheastSheet

WriteUps

Papers

Digital Investigation

DFRWS USA 2022

DFRWS EU 2022

DFRWS USA 2021

DFRWS EU 2021

DFRWS USA 2020

DFRWS EU 2020

Datasets

Challenges

Contributors

Thank you for your contribution!

We welcome any contribution to the extent that Code of Conduct and the License comply.