Difference between pages "HBGary Responder Professional" and "Volatility Framework"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
(Memory acquisition drivers)
 
Line 1: Line 1:
'''HBGary Responder Professional''' is a computer forensics suite distributed by [[HBGary]].
+
{{Infobox_Software |
 +
  name = Volatility |
 +
  maintainer = [[AAron Walters]] |
 +
  os = {{Cross-platform}} |
 +
  genre = {{Memory analysis}} |
 +
  license = {{GPL}} |
 +
  website = [https://www.volatilesystems.com/default/volatility https://www.volatilesystems.com/] |
 +
}}
  
[[File:logo.jpg]]
+
The '''Volatility Framework''' is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.  
  
Responder™ Professional is a leader in Windows™ physical memory and automated malware analysis. It is an
+
The project was originally developed by and is now headed up by [[AAron Walters]] of [[Volatile Systems]].
application that is known for its ease of use, streamlined workflow, and rapid results. The Professional platform is designed for Incident Responders, Malware Analysts, and Computer Forensic Investigators who demand the very best. Responder Professional provides powerful memory
+
 
forensics, malware detection, and software behavioral identification with Digital DNA™.
+
== Plugins ==
 +
See: [[List of Volatility Plugins]]
 +
 
 +
== Memory acquisition drivers ==
 +
 
 +
In 2012 [[Michael Cohen]] contributed both a Linux and a Windows Open Source memory (acquisition) driver to the volatility project.
 +
 
 +
These drivers are currently available in the volatility scudette branch and soon to be released as a separate download. To obtain this branch run:
 +
<pre>
 +
svn checkout http://volatility.googlecode.com/svn/branches/scudette/ volatility
 +
</pre>
 +
 
 +
In the scudette branch the drivers can be found under:
 +
<pre>
 +
volatility/tools/linux
 +
volatility/tools/windows
 +
</pre>
 +
 
 +
=== Linux ===
 +
 
 +
To build the kernel module for the current kernel version, make sure you have a working build environment and the kernel headers installed. Change into this directory and run make:
 +
<pre>
 +
cd volatility/tools/linux/
 +
make
 +
</pre>
 +
 
 +
The acquisition driver is named pmem.ko.
 +
 
 +
To load the driver:
 +
<pre>
 +
sudo insmod pmem.ko
 +
</pre>
 +
 
 +
To check if the driver is running:
 +
<pre>
 +
sudo lsmod
 +
</pre>
 +
 
 +
The driver create a device file named:
 +
<pre>
 +
/dev/pmem
 +
</pre>
 +
 
 +
To unload the driver:
 +
<pre>
 +
sudo rmmod pmem
 +
</pre>
 +
 
 +
To read acquire the memory just read from the device file. e.g.
 +
<pre>
 +
dd if=/dev/pmem of=image.raw
 +
</pre>
 +
 
 +
For more information see:
 +
<pre>
 +
volatility/tools/linux/README
 +
</pre>
 +
 
 +
=== Mac OS X ===
 +
 
 +
A Mac OS X driver is currently being worked on.
 +
 
 +
=== Windows ===
 +
Since recent versions of 64 bit Windows require a signed driver the volatility scudette branch comes with both pre-built (binary) and source versions of the driver. The prebuilt binary is signed.
 +
 
 +
Both the i386 and amd64 binary version of the driver can be found on the [http://code.google.com/p/volatility/downloads/list downloads] part of the Volatility code repository as winpmem or in the scudette branch under:
 +
<pre>
 +
volatility/tools/winpmem/binaries/
 +
</pre>
 +
 
 +
E.g.
 +
<pre>
 +
volatility/tools/winpmem/binaries/amd64/winpmem.sys
 +
</pre>
 +
 
 +
A standalone tool for imaging memory that uses an embedded copy of the pmem driver can be found as winpmem.exe in:
 +
<pre>
 +
volatility/tools/winpmem/executables/Release/
 +
</pre>
 +
 
 +
To load the driver:
 +
<pre>
 +
winpmem.exe -l
 +
</pre>
 +
 
 +
The device filename is (This can not be changed without recompiling):
 +
<pre>
 +
\\.\pmem
 +
</pre>
 +
 
 +
To read and acquire the physical memory and write it to image.raw:
 +
<pre>
 +
winpmem.exe image.raw
 +
</pre>
 +
 
 +
To unload the driver:
 +
<pre>
 +
winpmem.exe -u
 +
</pre>
 +
 
 +
For more information see:
 +
<pre>
 +
volatility/tools/windows/README
 +
</pre>
 +
 
 +
== See Also ==
 +
* [[List of Volatility Plugins]]
 +
 
 +
== External Links ==
 +
* [https://www.volatilesystems.com/default/volatility Official web site]
 +
* [http://code.google.com/p/volatility/ Code repository], direct link to [http://code.google.com/p/volatility/source/browse/ source]
 +
* [http://code.google.com/p/volatility/w/list Volatility Documentation]

Revision as of 06:02, 27 July 2012

Volatility
Maintainer: AAron Walters
OS: Cross-platform
Genre: Memory Analysis
License: GPL
Website: https://www.volatilesystems.com/

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

The project was originally developed by and is now headed up by AAron Walters of Volatile Systems.

Plugins

See: List of Volatility Plugins

Memory acquisition drivers

In 2012 Michael Cohen contributed both a Linux and a Windows Open Source memory (acquisition) driver to the volatility project.

These drivers are currently available in the volatility scudette branch and soon to be released as a separate download. To obtain this branch run:

svn checkout http://volatility.googlecode.com/svn/branches/scudette/ volatility

In the scudette branch the drivers can be found under:

volatility/tools/linux
volatility/tools/windows

Linux

To build the kernel module for the current kernel version, make sure you have a working build environment and the kernel headers installed. Change into this directory and run make:

cd volatility/tools/linux/
make

The acquisition driver is named pmem.ko.

To load the driver:

sudo insmod pmem.ko

To check if the driver is running:

sudo lsmod

The driver create a device file named:

/dev/pmem

To unload the driver:

sudo rmmod pmem

To read acquire the memory just read from the device file. e.g.

dd if=/dev/pmem of=image.raw

For more information see:

volatility/tools/linux/README

Mac OS X

A Mac OS X driver is currently being worked on.

Windows

Since recent versions of 64 bit Windows require a signed driver the volatility scudette branch comes with both pre-built (binary) and source versions of the driver. The prebuilt binary is signed.

Both the i386 and amd64 binary version of the driver can be found on the downloads part of the Volatility code repository as winpmem or in the scudette branch under:

volatility/tools/winpmem/binaries/

E.g.

volatility/tools/winpmem/binaries/amd64/winpmem.sys

A standalone tool for imaging memory that uses an embedded copy of the pmem driver can be found as winpmem.exe in:

volatility/tools/winpmem/executables/Release/

To load the driver:

winpmem.exe -l

The device filename is (This can not be changed without recompiling):

\\.\pmem

To read and acquire the physical memory and write it to image.raw:

winpmem.exe image.raw

To unload the driver:

winpmem.exe -u 

For more information see:

volatility/tools/windows/README

See Also

External Links