Difference between revisions of "Linux Memory Analysis"

From Forensics Wiki
Jump to: navigation, search
(Linux Memory Analysis Tools: update volatility linux support link)
 
(One intermediate revision by one user not shown)
Line 3: Line 3:
 
==Linux Memory Analysis Tools==
 
==Linux Memory Analysis Tools==
  
Research Projects:
+
Active Open Source Projects:
* The [http://4tphi.net/fatkit/ Forensic Analysis Toolkit (FATKit)] is a cross-platform, modular, and extensible digital investigation framework for analyzing volatile system memory.  (Publication Date: 2006; Availability/License: not available)
+
* The [https://www.volatilesystems.com/default/volatility Volatility Framework] is a collection of tools, implemented in Python, for the extraction of digital artifacts from volatile memory (RAM) samples.  See the [http://code.google.com/p/volatility/wiki/LinuxMemoryForensics LinuxMemoryForensics] page on the Volatility wiki.  (Availability/License: GNU GPL)
 +
* The [http://people.redhat.com/anderson/ Red Hat Crash Utility] is an extensible Linux kernel core dump analysis program.  Although designed as a debugging tool, it also has been utilized for memory forensics.  See, for example, the [http://volatilesystems.blogspot.com/2008/07/linux-memory-analysis-one-of-major.html 2008 DFRWS challenge write-up by AAron Walters].  (Availability/License: GNU GPL)
  
Open Source Projects:
+
Commercial Products:
* The [https://www.volatilesystems.com/default/volatility Volatility Framework] is a collection of tools, implemented in Python, for the extraction of digital artifacts from volatile memory (RAM) samplesSupport for Linux is experimental--see the [http://code.google.com/p/volatility/wiki/LinuxMemoryForensics LinuxMemoryForensics] page on the Volatility wiki.  (Availability/License: GNU GPL)
+
* [[Second Look]] provides memory acquisition and analysis tools for Linux incident response and enterprise security. Its major differentiators versus Volatility are malware detection via integrity verification of the kernel and running processes, ease of use (automatic kernel version detection, a graphical user interface, etc.), and enterprise scalability (including live analysis of remote systems via a memory access agent).  (Availability/License: commercial)
 +
 
 +
Inactive Open Source and Research Projects:
 +
* The [http://4tphi.net/fatkit/ Forensic Analysis Toolkit (FATKit)] is a cross-platform, modular, and extensible digital investigation framework for analyzing volatile system memory.  (Publication Date: 2006; Availability/License: not available)
 
* [http://hysteria.sk/~niekt0/foriana/ Foriana] is tool for extraction of information such as the process and modules lists from a RAM image using logical relations between OS structures.  (Availability/License: GNU GPL)
 
* [http://hysteria.sk/~niekt0/foriana/ Foriana] is tool for extraction of information such as the process and modules lists from a RAM image using logical relations between OS structures.  (Availability/License: GNU GPL)
 
* [http://code.google.com/p/draugr/ Draugr] is a Linux memory forensics tool written in Python.  (Availability/License: GNU GPL)
 
* [http://code.google.com/p/draugr/ Draugr] is a Linux memory forensics tool written in Python.  (Availability/License: GNU GPL)
 
* [http://code.google.com/p/volatilitux/ Volatilitux] is another Linux memory forensics tool written in Python.  (Availability/License: GNU GPL)
 
* [http://code.google.com/p/volatilitux/ Volatilitux] is another Linux memory forensics tool written in Python.  (Availability/License: GNU GPL)
* The [http://people.redhat.com/anderson/ Red Hat Crash Utility] is an extensible Linux kernel core dump analysis program.  Although designed as a debugging tool, it also has been utilized for memory forensics.  See, for example, the [http://volatilesystems.blogspot.com/2008/07/linux-memory-analysis-one-of-major.html 2008 DFRWS challenge write-up by AAron Walters].  (Availability/License: GNU GPL)
+
* Idetect (Linux) http://forensic.seccure.net/ is an older implementation of Linux memory analysis.
* Idetect (Linux) http://forensic.seccure.net/ is an older implementation of Linux memory analysis.  
+
 
+
Commercial Products:
+
* [[Second Look: Linux Memory Forensics]] from [http://www.pikewerks.com Raytheon Pikewerks Corporation] can analyze live memory or stored snapshots (physical memory images).  It can be used to detect rootkits and other kernel-hooking malware, unauthorized applications and services, and stealthy user-level malware, as well as obtain forensic information about the state of the system.  It has command-line and GUI interfaces, and reverse engineering capabilities including built-in disassembly and hexadecimal data views.  An online reference kernel repository provides baselines for verification of thousands of distribution stock kernels, while an online pagehash database provides the baselines for verification of hundreds of thousands of Linux software packages.  As of April 2012, it supports x86 and x86_64 targets running any 2.6-series kernel and 3-series kernels up to 3.2.  (Availability/License: commercial)
+
  
 
==Linux Memory Analysis Challenges==
 
==Linux Memory Analysis Challenges==
Line 44: Line 44:
 
* http://lists.volatilesystems.com/pipermail/vol-users/2010-January/thread.html#143
 
* http://lists.volatilesystems.com/pipermail/vol-users/2010-January/thread.html#143
 
* http://lists.volatilesystems.com/pipermail/vol-dev/2010-September/thread.html#112
 
* http://lists.volatilesystems.com/pipermail/vol-dev/2010-September/thread.html#112
 +
 +
[[Category:Memory Analysis]]

Latest revision as of 14:42, 13 November 2013

The output of a memory acquisition tool is a memory image which contains the raw physical memory of a system. A wide variety of tools can be used to search for strings or other patterns in a memory image, but to extract higher-level information about the state of the system a memory analysis tool is required.

Contents

Linux Memory Analysis Tools

Active Open Source Projects:

Commercial Products:

  • Second Look provides memory acquisition and analysis tools for Linux incident response and enterprise security. Its major differentiators versus Volatility are malware detection via integrity verification of the kernel and running processes, ease of use (automatic kernel version detection, a graphical user interface, etc.), and enterprise scalability (including live analysis of remote systems via a memory access agent). (Availability/License: commercial)

Inactive Open Source and Research Projects:

  • The Forensic Analysis Toolkit (FATKit) is a cross-platform, modular, and extensible digital investigation framework for analyzing volatile system memory. (Publication Date: 2006; Availability/License: not available)
  • Foriana is tool for extraction of information such as the process and modules lists from a RAM image using logical relations between OS structures. (Availability/License: GNU GPL)
  • Draugr is a Linux memory forensics tool written in Python. (Availability/License: GNU GPL)
  • Volatilitux is another Linux memory forensics tool written in Python. (Availability/License: GNU GPL)
  • Idetect (Linux) http://forensic.seccure.net/ is an older implementation of Linux memory analysis.

Linux Memory Analysis Challenges

Linux Memory Images

Aside from those in the challenges referenced above, sample Linux memory images can also be found on the Second Look web site at http://secondlookforensics.com/images.html.

Linux Memory Analysis Bibliography

Volatility Mailing List Threads on Support for Linux: