Difference between pages "Tools:Data Recovery" and "Memory analysis"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
(Carving)
 
(See Also)
 
Line 1: Line 1:
{{Wikify}}
+
'''Memory Analysis''' is the science of using a [[Tools:Memory Imaging|memory image]] to determine information about running programs, the [[operating system]], and the overall state of a computer. Because the analysis is highly dependent on the operating system, we have broken it into subpages:
  
= Partition Recovery =
+
* [[Windows Memory Analysis]]
 +
* [[Linux Memory Analysis]]
  
; [[Partition Table Doctor]]
+
== OS-Independent Analysis ==
: http://www.ptdd.com/index.htm
+
  
; [[parted]]
+
At the IEEE Security and Privacy conference in May 2011, Brendan Dolan-Gavitt presented a novel system, [http://www.cc.gatech.edu/~brendan/Virtuoso_Oakland.pdf Virtuoso], that was able to perform operating-system independent memory analysis. Using virtual machine introspection accompanied by a number of formal program analysis techniques, his system was able to monitor the machine-level instructions and behavior of application actions (listing processes, network connections, etc) and then automatically generate Volatility plugins that replicated this analysis.
: The Linux partition management tool.
+
  
; [[Active Partition Recovery]]
+
== Encryption Keys ==
: ...
+
  
; [[gpart]]
+
Various types of encryption keys can be extracted during memory analysis.
: http://www.stud.uni-hannover.de/user/76201/gpart/
+
You can use [[AESKeyFinder]] to extract 128-bit and 256-bit [[AES]] keys and [[RSAKeyFinder]] to extract all private and public [[RSA]] keys from a memory dump [http://citp.princeton.edu/memory/code/]. [http://jessekornblum.com/tools/volatility/cryptoscan.py cryptoscan.py] ([[List of Volatility Plugins|plugin for the Volatility memory analysis framework]]) scans a memory image for [[TrueCrypt]] passphrases.
  
; [[Testdisk]]
+
== See Also ==
: http://www.cgsecurity.org/wiki/TestDisk
+
  
== See Also ==
+
* [[Memory Imaging]]
 +
* [[:Tools:Memory Imaging|Memory Imaging Tools]]
 +
* [[:Tools:Memory Analysis|Memory Analysis Tools]]
  
* [http://support.microsoft.com/?kbid=166997 Using Norton Disk Edit to Backup Your Master Boot Record]
+
[[Category:Memory Analysis]]
 
+
== Notes ==
+
 
+
* "fdisk /mbr" restores the boot code in the [[MBR]], but not the partition itself.
+
= Data Recovery =
+
 
+
; [[BringBack]]
+
: http://www.toolsthatwork.com/
+
: BringBack offers easy to use, inexpensive, and highly successful data recovery for Windows and Linux (ext2) operating systems and digital images stored on memory cards, etc.
+
 
+
; [[ByteBack Data Recovery Investigative Suite v4.0]]
+
: http://www.toolsthatwork.com
+
: Now with UDMA, ATA & SATA support, memory management and greater ease and control of partition and MBR manipulations, ByteBack continues to uphold it's viability as the computer forensics and recovery application of professionals.
+
 
+
; [[RAID Reconstructor]]
+
: http://www.runtime.org/raid.htm
+
: Runtime Software's RAID Reconstructor will reconstruct [[RAID Level 0]] (Striping) and [[RAID Level 5]] drives.
+
 
+
; [[Salvation Data]]
+
: http://www.salvationdata.com
+
: Claims to have a program that can read the "[[bad blocks]]" of [[Maxtor]] drives with proprietary commands.
+
 
+
=Carving=
+
; [[DataLifter DataLifter® - File Extractor Pro]]
+
: http://www.datalifter.com/products.htm
+
 
+
; [[Scalpel]]
+
: Currently the most popular open-source carving tool.
+
 
+
; [[EnCase]]
+
: EnCase comes with some eScripts that will do carving.
+
 
+
; [[CarvFs]]
+
A virtual filesystem (fuse) implementation that can provide carving tools
+
with the posibility to do recursive multi tool zero-storage carving
+
(also called in-place carving). Patches and scripts for scalpel and
+
foremost are provided. Works on raw and encase images.
+
: http://ocfa.sourceforge.net/libcarvpath/
+
 
+
; [[LibCarvPath]]
+
: http://ocfa.sourceforge.net/libcarvpath/
+
A shared library that allows carving tools to use zero-storage carving on
+
carvfs virtual files.
+

Revision as of 06:04, 27 July 2012

Memory Analysis is the science of using a memory image to determine information about running programs, the operating system, and the overall state of a computer. Because the analysis is highly dependent on the operating system, we have broken it into subpages:

OS-Independent Analysis

At the IEEE Security and Privacy conference in May 2011, Brendan Dolan-Gavitt presented a novel system, Virtuoso, that was able to perform operating-system independent memory analysis. Using virtual machine introspection accompanied by a number of formal program analysis techniques, his system was able to monitor the machine-level instructions and behavior of application actions (listing processes, network connections, etc) and then automatically generate Volatility plugins that replicated this analysis.

Encryption Keys

Various types of encryption keys can be extracted during memory analysis. You can use AESKeyFinder to extract 128-bit and 256-bit AES keys and RSAKeyFinder to extract all private and public RSA keys from a memory dump [1]. cryptoscan.py (plugin for the Volatility memory analysis framework) scans a memory image for TrueCrypt passphrases.

See Also