Lesson 2.33: Taking a copy of memory
Memory holds what the disk doesn't: running processes (hidden ones too), network connections, command history that was never saved, decryption keys, loaded kernel modules. It is also the first evidence to disappear: a reboot or even a few hours of activity overwrite it. In the lab the customer database db02 shows signs of a kernel-level rootkit. Before anyone touches it, you record the kernel version, copy RAM to the evidence disk with AVML, hash the image, log the chain of custody and check that Volatility can read it.
16 min
You will learn to
- Explain why memory is acquired first
- Record the kernel version needed for analysis
- Acquire RAM with AVML to separate storage
- Hash the image and record the chain of custody
- Check symbols and a first Volatility read
Key terms
- Memory acquisition
- Copying physical RAM into a file for later analysis.
- AVML
- Acquire Volatile Memory for Linux: a static tool that writes RAM as a LiME image.
- LiME format
- A memory image format that stores RAM ranges with their physical addresses.
- Volatility 3
- Memory forensics framework; linux.* plugins read processes, modules, history and more from an image.
- Symbol table (ISF)
- Kernel structure layouts for one exact kernel build, needed by Volatility.
- Chain of custody
- The record of who handled evidence, when and how.
← Collecting a triage package · All lessons · Links and lookalike domains →