5

I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows 7 64 bit SP1). I have downloaded a live memory analysis tool named Volatility and tried the first command:

python vol.py pslist -f /path/to/memory.img --profile=Win7SP1x64=

I got an error stating that I don't have image or file for analysis and realised I have no clue how to dump live O/S memory into a file.

I did some Google search for tools e.g encase, helix, MDD, hBGARY but found these tools to be far complex for my current knowledge about this field. Furthermore these tools aren't free.

Note that I am NOT looking for recommendations for which tool to use, I would like to understand the process and how to go about taking memory dumps for forensics.

Improve this question
6
  • Try DumpIt. The dumps can be used with volatility.
    – Zzz
    Aug 18, 2012 at 22:43
  • 1
    RamCapture worked for me pretty well - it just needs admin rights. forensic.belkasoft.com/en/ram/download.asp
    – kravietz
    Apr 4, 2013 at 14:34
  • I believe that ProcDump also works and is maintained by Microsoft. It allows a dump to occur when certain conditions are met like a high CPU usage.
    – Andrew Stern
    Jun 19, 2013 at 17:44
  • Isn't the memory stored in hiberfil.sys when you hibernate? You could read that file with a Linux live boot.
    – Luc
    Jun 19, 2013 at 19:33
  • I recommend Rekall (rekall-forensic.com) over Volatility.
    – user84089
    Aug 22, 2015 at 16:51

2 Answers 2

Reset to default
10

If you google for forensic memory dump tools, one of the first ones to come up is the free Microsoft SysInternals tool, LiveKd. Helix is also free, and has greater functionality. Download the Helix ISO and have a good look at the tools available.

As far as complexity, all these tools provide a wide range of functionality. This shouldn't be confused with being too complex, as you will just use the functions you need. This goes for Volatility as well.

Improve this answer
2
  • LiveKd rocks. Not sure what I'd do without it.
    – Polynomial
    Aug 19, 2012 at 20:03
  • Found a post stating that running the following command in LiveKd will dump live memory .dump /f C:\memory.dmp Nice!
    – user2320464
    Jan 19, 2016 at 18:20
1

Microsoft has a knowledge base article about this for debugging which will effectively provide the desired result.

How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2

Forensics Wiki maintains a great list. Note that some tools only work for x86 so be sure x64 is also supported (i.e. FTK Imager).

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.