5

I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows 7 64 bit SP1). I have downloaded a live memory analysis tool named Volatility and tried the first command:

python vol.py pslist -f /path/to/memory.img --profile=Win7SP1x64=

I got an error stating that I don't have image or file for analysis and realised I have no clue how to dump live O/S memory into a file.

I did some Google search for tools e.g encase, helix, MDD, hBGARY but found these tools to be far complex for my current knowledge about this field. Furthermore these tools aren't free.

Note that I am NOT looking for recommendations for which tool to use, I would like to understand the process and how to go about taking memory dumps for forensics.

|improve this question|||||
  • Try DumpIt. The dumps can be used with volatility. – Zzz Aug 18 '12 at 22:43
  • 1
    RamCapture worked for me pretty well - it just needs admin rights. forensic.belkasoft.com/en/ram/download.asp – kravietz Apr 4 '13 at 14:34
  • I believe that ProcDump also works and is maintained by Microsoft. It allows a dump to occur when certain conditions are met like a high CPU usage. – Andrew Stern Jun 19 '13 at 17:44
  • Isn't the memory stored in hiberfil.sys when you hibernate? You could read that file with a Linux live boot. – Luc Jun 19 '13 at 19:33
  • I recommend Rekall (rekall-forensic.com) over Volatility. – user84089 Aug 22 '15 at 16:51
10

If you google for forensic memory dump tools, one of the first ones to come up is the free Microsoft SysInternals tool, LiveKd. Helix is also free, and has greater functionality. Download the Helix ISO and have a good look at the tools available.

As far as complexity, all these tools provide a wide range of functionality. This shouldn't be confused with being too complex, as you will just use the functions you need. This goes for Volatility as well.

|improve this answer|||||
  • LiveKd rocks. Not sure what I'd do without it. – Polynomial Aug 19 '12 at 20:03
  • Found a post stating that running the following command in LiveKd will dump live memory .dump /f C:\memory.dmp Nice! – user2320464 Jan 19 '16 at 18:20
1

Microsoft has a knowledge base article about this for debugging which will effectively provide the desired result.

How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2

Forensics Wiki maintains a great list. Note that some tools only work for x86 so be sure x64 is also supported (i.e. FTK Imager).

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.