how to discover ephemeral evidence with Live RAM analysis

 Standard practice until very recently  Many types of evidence lost ◦ Communications in social networks ◦ Data on running processes ◦ Open network connections ◦ Access to encrypted volumes ◦ Many-many more  1-8 Gb of potential evidence!

 Essential for discovering important evidence  Should become a standard procedure

 Running processes and services  System information ◦ e.g. time lapsed since last reboot  Information about logged users  Registry information  Open network connections  ARP cache  Remnants of Instant Messenger chats  Communications in social networks  MMORPG games chats

 Recent Web browsing activities ◦ including InPrivate modes and similar  Recent communications via Webmails  Information from cloud services  Decryption keys for encrypted volumes  Recently viewed pictures  Running malware and trojans

 Ephemeral nature of evidence  Memory is gone in seconds  Only the most recent data (e.g. Facebook chats)

 Careful assessment of risk vs. potential benefits  Capturing a memory dump for off-line analysis  Continuing with live box analysis ◦ If you know why (e.g. secure VPN connections) ◦ If you evaluated the risks  Memory dump is then analyzed on investigator’s PC

Official ACPO Guidelines for capturing memory dumps:  Perform a risk assessment of the situation  Install a capture device (e.g. USB flash drive)  Run collection script  Once complete, stop the device  Remove the device  Verify the output on a separate forensic investigation machine ◦ not the suspect system!  Immediately follow with standard power-off procedure.

There are certain strict requirements for tools used for acquiring memory dumps:  Kernel-mode operation  Smallest footprint possible  Portability  Read-only access

 What is kernel-mode?  Why is that needed? ◦ Proactive RAM protection  What if a tool uses user-mode? ◦ Zeroes instead actual memory ◦ Faked memory ◦ Destroying evidence ◦ Locking or rebooting computer

 FTK Imager  PMDump  Both run in user mode  Test your current memory dumping tool!

 Karos: popular multi-user online game

 Made some Karos chats, created RAM dump  FTK Imager: all zeroes  PMDump: no Karos chats found  Belkasoft Live RAM Capturer: all chats perfectly found

 Loading capturer application requires RAM memory ◦ Potentially overwriting evidence or important data  Thus, smallest footprint is desired

 Tool should be able to run from a thumb drive  No installation allowed  No third-party libraries should be counted on

 All data should be stored to a removable device  Collected data must fit No using 8 GB pen drives for acquiring 8 GB RAM  No data alterations allowed on suspect’s machine

 Small free utility satisfying all forensic requirements

 Both 32 and 64 bit versions available  Tiny:140 KB (32-bit) and 167 KB (64-bit)  Runs in kernel mode  Portable  Read-only  Successfully passes the “Karos test”

 Technique to capture RAM from another machine ◦ Does not affect source computer memory  Exploits a known security issue ◦ Issue exists in all three main OS’es (though patches are known)  Based on DMA (direct memory access)

 FireWire drivers are not disabled ◦ Mac OS disables them when OS is locked  FireWire port exists  Or special hardware inserted ◦ PCMCIA card ◦ CardBus ◦ ExpressCard See memory-attacks-via-firewire-dma-part-1- overview-and-mitigationhttp:// memory-attacks-via-firewire-dma-part-1- overview-and-mitigation

 Recent experiment  Attack to encrypted smartphone memory  Use ordinary freezer to slow down RAM leak  Cooled phone is reset in fastboot mode ◦ Then special FROST software used  Result: ◦ encryption keys found ◦ RAM memory captured ◦ lock screen keys cracked

 No all-in-one silver bullet so far  Belkasoft Evidence Center ◦ Finds chats, browsers, webmails, P2P, MMORPG, social networks remnants and many more  Elcomsoft Forensic Disk Decryptor ◦ Extracts decryption keys for encrypted volumes  Passware Kit Forensic ◦ Extracts decryption keys for encrypted volumes ◦ Captures RAM using Firewire attack

 Leave me your business card  Come visit us at our booth and leave your address Also  Write us to  Attend our FREE webinar at

 Completely FREE fully featured one-month license for conference attendees!  More info at

 Live RAM Capturer is free, Evidence Center is a commercial product  For all order-related questions please visit  or contact us by sending an to