I am currently writing a thesis about digital forensics which includes a chapter

Question

I am currently writing a thesis about digital forensics which includes a chapter about memory forensics. Besides the tools and the methods of acquiring various data with them, I am kind of desperate to find information about how these tools (eg Volatility) are actually working in theory. For example, how they identify offsets, processes, connections, differences in memory depending on the OS by looking at the raw dump or any other way.

How do memory analysis tools work? What method do they use? I can't seem to find much information about this.

Explanation / Answer

A lot of analysis tools look for known data structures (i.e., patterns) in memory that indicate a particular type of information.

For instance, malloc'd memory has header (and sometimes trailer) data that point forward and backward in memory to adjacent memory. Free'd memory pointers can jump around in memory if they aren't consolidated/coalesced.

Windows C++ applications have the notion of classes and a "this" pointer, which points to a class. The structure of C++ classes is known, so when one of these pointers is found a lot of information about the class can be derived. If it is a known class/data-type then it can be parsed relatively easily.

File's open in memory can be discovered by their "file signatures" (usually the first 3 or so bytes of the file). If those are found, some quick analysis can be done to determine if it's actually a legitimate file of that type or if it was dumb luck that those bytes occurred.

So, in general, many memory analysis tools look for known patterns in memory and/or hook into key datastructures within the kernel and then parse memory from there. Once you find code areas, you can "disassemble" them and find references (pointers) to other regions of memory. And following those you can find other data structures.

I hope that helps some.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.