[Rekall] Memory Forensics Analysis Framework

The Rekall Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

Rekall should run on any platform that supports Python (http://www.python.org)

Rekall supports investigations of the following x86 bit memory images:

• Microsoft Windows XP Service Pack 2 and 3
• Microsoft Windows 7 Service Pack 0 and 1
• Linux Kernels 2.6.24 to 3.10.
• OSX 10.6-10.8.

Rekall also provides a complete memory sample acquisition capability for all major operating systems (see the tools directory).

Download Rekall

Read More

[Memoryze] Find Evil in Live Memory (Memory Forensic Software)

Mandiant’s Memoryze is free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the paging file in its analysis.

Mandiant’s Memoryze features:

• image the full range of system memory (not reliant on API calls).
• image a process’ entire address space to disk. This includes a process’ loaded DLLs, EXEs, heaps and stacks.
• image a specified driver or all drivers loaded in memory to disk.
• enumerate all running processes (including those hidden by rootkits). For each process, Memoryze can:
• report all open handles in a process (for example, all files, registry keys, etc.).
• list the virtual address space of a given process including:
• displaying all loaded DLLs.
• displaying all allocated portions of the heap and execution stack.
• list all network sockets that the process has open, including any hidden by rootkits.
• specify the functions imported by the EXE and DLLs.
• specify the functions exported by the EXE and DLLs.
• hash the EXE and DLLs in the process address space (MD5, SHA1, SHA256.  This is disk based.)
• hash the EXE and DLLs in the process address space. (This is a MemD5 of the binary in memory).
• verify the digital signatures of the EXE and DLLs. (This is disk based.)
• output all strings in memory on a per process basis.
• identify all drivers loaded in memory, including those hidden by rootkits. For each driver, Memoryze can:
• specify the functions the driver imports.
• specify the functions the driver exports.
• hash the driver. (MD5, SHA1, SHA256. this is disk based.)
• verify the digital signature of the driver (This is disk based.)
• output all strings in memory on a per driver base.
• report device and driver layering, which can be used to intercept network packets, keystrokes and file activity.
• identify all loaded kernel modules by walking a linked list.
• identify hooks (often used by rootkits) in the System Call Table, the Interrupt Descriptor Tables (IDTs) and driver function tables (IRP tables).

Mandiant’s Memoryze can perform all these functions on live system memory or memory image files – whether they were acquired by Memoryze or other memory acquisition tools.

Memoryze officially supports:

• Windows 2000 Service Pack 4 (32-bit)
• Windows XP Service Pack 2 and Service Pack 3 (32-bit)
• Windows Vista Service Pack 1 and Service Pack 2 (32-bit)
• *Windows Vista Service Pack 2 (64-bit)
• Windows 2003 Service Pack 2 (32-bit and 64-bit)
• Windows 7 Service Pack 0 (32-bit and 64-bit)
• *Windows 2008 Service Pack 1 and Service Pack 2 (32-bit)
• Windows 2008 R2 Service Pack 0 (64-bit)
• *Windows 8 Service Pack 0 (32-bit and 64-bit)
• *Windows Server 2012 Service Pack 0 (64-bit)

* means support for a new operating system without experience on millions of host

In order to visualize Memoryze’s output, please download Redline™ or use an XML viewer.  Redline is Mandiant’s premier free tool for investigating hosts for signs of malicious activity through memory and file analysis, and the development of a threat assessment profile.

Download Memoryze

Read More

[The Volatility Framework] An advanced memory forensics framework

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

• Windows Malware and Memory Forensics Training by The Volatility Project
• Mar 2013 in Chicago, IL
• Dec 2012 in Reston, VA
• Download the latest release: Volatility Framework 2.2
• Read documentation on our wiki

Volatility supports memory dumps from all major 32- and 64-bit Windows versions and service packs including XP, 2003 Server, Vista, Server 2008, Server 2008 R2, and Seven. Whether your memory dump is in raw format, a Microsoft crash dump, hibernation file, or virtual machine snapshot, Volatility is able to work with it. We also now support Linux memory dumps in raw or LiME format and include 35+ plugins for analyzing 32- and 64-bit Linux kernels from 2.6.11 - 3.5.x and distributions such as Debian, Ubuntu, OpenSuSE, Fedora, CentOS, and Mandrake. Official OSX and Android support are coming!

Download The Volatility Framework

Read More