Linux Memory Analysis - Revision history

Joachim Metz at 09:29, 27 July 2012

2012-07-27T09:29:10Z

Andrewtappert: /* Linux Memory Analysis Tools */ update volatility linux support link

2012-05-01T01:51:54Z

‎Linux Memory Analysis Tools: update volatility linux support link

Andrewtappert: add 'linux memory images' section

2012-04-30T23:23:53Z

add 'linux memory images' section

Andrewtappert: update second look info

2012-04-17T14:48:32Z

update second look info

Darrenb: /* Linux Memory Analysis Tools */

2011-09-27T10:21:14Z

‎Linux Memory Analysis Tools

Andrew Case at 18:52, 11 September 2011

2011-09-11T18:52:06Z

Andrewtappert: add challenge

2011-08-12T14:40:21Z

add challenge

Andrewtappert: add intro

2011-08-12T14:12:48Z

add intro

Andrewtappert at 20:42, 26 May 2011

2011-05-26T20:42:24Z

Andrewtappert at 19:34, 13 May 2011

2011-05-13T19:34:12Z

← Older revision		Revision as of 09:29, 27 July 2012
Line 44:		Line 44:
	* http://lists.volatilesystems.com/pipermail/vol-users/2010-January/thread.html#143		* http://lists.volatilesystems.com/pipermail/vol-users/2010-January/thread.html#143
	* http://lists.volatilesystems.com/pipermail/vol-dev/2010-September/thread.html#112		* http://lists.volatilesystems.com/pipermail/vol-dev/2010-September/thread.html#112
		+
		+	[[Category:Memory Analysis]]

@@ Line 7: / Line 7: @@
 Open Source Projects:
-* The [https://www.volatilesystems.com/default/volatility Volatility Framework] is a collection of tools, implemented in Python, for the extraction of digital artifacts from volatile memory (RAM) samples.  Support for Linux is experimental, but available from Subversion in the [http://code.google.com/p/volatility/source/browse/#svn%2Fbranches%2Flinux-support linux-support branch].  (Availability/License: GNU GPL)
+* The [https://www.volatilesystems.com/default/volatility Volatility Framework] is a collection of tools, implemented in Python, for the extraction of digital artifacts from volatile memory (RAM) samples.  Support for Linux is experimental--see the [http://code.google.com/p/volatility/wiki/LinuxMemoryForensics LinuxMemoryForensics] page on the Volatility wiki.  (Availability/License: GNU GPL)
 * [http://hysteria.sk/~niekt0/foriana/ Foriana] is tool for extraction of information such as the process and modules lists from a RAM image using logical relations between OS structures.  (Availability/License: GNU GPL)
 * [http://code.google.com/p/draugr/ Draugr] is a Linux memory forensics tool written in Python.  (Availability/License: GNU GPL)

@@ Line 22: / Line 22: @@
 * [http://communaute.sstic.org/ChallengeSSTIC2010 Challenge SSTIC 2010] (French) dealt with analysis of physical memory from a mobile device running Android.
 * [http://www.honeynet.org/challenges/2011_7_compromised_server Challenge 7 of the Honeynet Project's Forensic Challenge 2011] included forensic analysis of a memory image from a potentially compromised Linux server.
 ==Linux Memory Analysis Bibliography==

@@ Line 13: / Line 13: @@
 * The [http://people.redhat.com/anderson/ Red Hat Crash Utility] is an extensible Linux kernel core dump analysis program.  Although designed as a debugging tool, it also has been utilized for memory forensics.  See, for example, the [http://volatilesystems.blogspot.com/2008/07/linux-memory-analysis-one-of-major.html 2008 DFRWS challenge write-up by AAron Walters].  (Availability/License: GNU GPL)
 * Idetect (Linux) http://forensic.seccure.net/ is an older implementation of Linux memory analysis.
 Commercial Products:
-* [[Second Look: Linux Memory Forensics]] from [http://www.pikewerks.com Pikewerks Corporation] can analyze live memory or stored snapshots (physical memory images).  It can be used to detect rootkits and other kernel-hooking malware, as well as obtain forensic information about the state of the system.  It has command-line and GUI interfaces, and reverse engineering capabilities including built-in disassembly and hexadecimal data views.  An online reference kernel repository provides baselines for verification of thousands of distribution stock kernels.  As of May 2011, it supports x86 and x86_64 targets running kernels 2.6.8 to 2.6.38.  (Availability/License: commercial)
+* [[Second Look: Linux Memory Forensics]] from [http://www.pikewerks.com Raytheon Pikewerks Corporation] can analyze live memory or stored snapshots (physical memory images).  It can be used to detect rootkits and other kernel-hooking malware, unauthorized applications and services, and stealthy user-level malware, as well as obtain forensic information about the state of the system.  It has command-line and GUI interfaces, and reverse engineering capabilities including built-in disassembly and hexadecimal data views.  An online reference kernel repository provides baselines for verification of thousands of distribution stock kernels, while an online pagehash database provides the baselines for verification of hundreds of thousands of Linux software packages.  As of April 2012, it supports x86 and x86_64 targets running any 2.6-series kernel and 3-series kernels up to 3.2.  (Availability/License: commercial)
 ==Linux Memory Analysis Challenges==
@@ Line 33: / Line 32: @@
 * [http://is.cuni.cz/studium/dipl_st/index.php?doo=detail&did=48540 Forensic RAM Dump Image Analyzer] by Ivor Kollar, describing the implementation of foriana, 2009.
 * [http://www.dfrws.org/2010/proceedings/2010-305.pdf Treasure and tragedy in kmem_cache mining for live forensics investigation] by Andrew Case, Lodovico Marziale, Cris Neckar, Golden G. Richard III; Digital Investigation, Volume 7, Supplement 1, The Proceedings of the Tenth Annual DFRWS Conference, August 2010.  [http://www.dfrws.org/2010/proceedings/richard2.pdf (Presentation)]
-* [http://www.pikewerks.com/sl/ Second Look Web Page], [http://www.pikewerks.com/_datasheets/secondlook.pdf Second Look Datasheet]
+* [http://secondlookforensics.com/ Second Look Web Page]
 * [http://blackhat.com/html/bh-dc-11/bh-dc-11-archives.html#Case De-Anonymizing Live CDs through Physical Memory Analysis] ([https://media.blackhat.com/bh-dc-11/Case/BlackHat_DC_2011_Case_De-Anonymizing_Live_CDs-wp.pdf Whitepaper]) ([https://media.blackhat.com/bh-dc-11/Case/BlackHat_DC_2011_Case_De-Anonymizing%20Live%20CDs-Slides.pdf Slides]) Andrew Case; Blackhat DC 2011.
 * [http://dfsforensics.blogspot.com/2011/03/bringing-linux-support-to-volatility.html Bringing Linux Support to Volatility], Andrew Case; Digital Forensics Solutions Blog, 2011.

@@ Line 12: / Line 12: @@
 * [http://code.google.com/p/volatilitux/ Volatilitux] is another Linux memory forensics tool written in Python.  (Availability/License: GNU GPL)
 * The [http://people.redhat.com/anderson/ Red Hat Crash Utility] is an extensible Linux kernel core dump analysis program.  Although designed as a debugging tool, it also has been utilized for memory forensics.  See, for example, the [http://volatilesystems.blogspot.com/2008/07/linux-memory-analysis-one-of-major.html 2008 DFRWS challenge write-up by AAron Walters].  (Availability/License: GNU GPL)
 Commercial Products:

@@ Line 23: / Line 23: @@
 ==Linux Memory Analysis Bibliography==
 * [http://www.usenix.org/events/usenix05/tech/freenix/full_papers/movall/movall.pdf Linux Physical Memory Analysis], Paul Movall, Ward Nelson, Shaun Wetzstein; Usenix, 2005.
 * [http://cisr.nps.edu/downloads/theses/06thesis_urrea.pdf An Analysis Of Linux RAM Forensics], J.M. Urrea, Masters Thesis, Naval Postgraduate School, 2006.
 * [http://volatilesystems.blogspot.com/2008/07/linux-memory-analysis-one-of-major.html Linux Memory Forensics for DFRWS Challenge 2008 using Volatility, Crash, and PyFlag], by AAron Walters on the Volatile Systems Blog.
 * [http://esiea-recherche.eu/~desnos/papers/slidesdraugr.pdf Linux Live Memory Forensics], a presentation by Desnos Anthony describing the implementation of draugr, 2009.
 * [http://is.cuni.cz/studium/dipl_st/index.php?doo=detail&did=48540 Forensic RAM Dump Image Analyzer] by Ivor Kollar, describing the implementation of foriana, 2009.
 * [http://www.dfrws.org/2010/proceedings/2010-305.pdf Treasure and tragedy in kmem_cache mining for live forensics investigation] by Andrew Case, Lodovico Marziale, Cris Neckar, Golden G. Richard III; Digital Investigation, Volume 7, Supplement 1, The Proceedings of the Tenth Annual DFRWS Conference, August 2010.  [http://www.dfrws.org/2010/proceedings/richard2.pdf (Presentation)]
 * [http://www.pikewerks.com/sl/ Second Look Web Page], [http://www.pikewerks.com/_datasheets/secondlook.pdf Second Look Datasheet]
-* [http://blackhat.com/html/bh-dc-11/bh-dc-11-archives.html#Case De-Anonymizing Live CDs through Physical Memory Analysis] ([https://media.blackhat.com/bh-dc-11/Case/BlackHat_DC_2011_Case_De-Anonymizing_Live_CDs-wp.pdf Whitepaper]) ([https://media.blackhat.com/bh-dc-11/Case/BlackHat_DC_2011_Case_De-Anonymizing%20Live%20CDs-Slides.pdf Slides]) Andrew Case; Blackhat USA 2010.
+* [http://blackhat.com/html/bh-dc-11/bh-dc-11-archives.html#Case De-Anonymizing Live CDs through Physical Memory Analysis] ([https://media.blackhat.com/bh-dc-11/Case/BlackHat_DC_2011_Case_De-Anonymizing_Live_CDs-wp.pdf Whitepaper]) ([https://media.blackhat.com/bh-dc-11/Case/BlackHat_DC_2011_Case_De-Anonymizing%20Live%20CDs-Slides.pdf Slides]) Andrew Case; Blackhat DC 2011.
 * [http://dfsforensics.blogspot.com/2011/03/bringing-linux-support-to-volatility.html Bringing Linux Support to Volatility], Andrew Case; Digital Forensics Solutions Blog, 2011.
 Volatility Mailing List Threads on Support for Linux:
 * http://lists.volatilesystems.com/pipermail/vol-users/2010-January/thread.html#143
 * http://lists.volatilesystems.com/pipermail/vol-dev/2010-September/thread.html#112

← Older revision		Revision as of 14:12, 12 August 2011
Line 1:		Line 1:
		+	The output of a [[Tools:Memory_Imaging\|memory acquisition tool]] is a memory image which contains the raw physical memory of a system. A wide variety of tools can be used to search for strings or other patterns in a memory image, but to extract higher-level information about the state of the system a memory analysis tool is required.
		+
	==Linux Memory Analysis Tools==		==Linux Memory Analysis Tools==