1. Responder Field Edition & Pro
Memory Forensics
A How To Guide For
Responder Field Edition & Pro
Prepare For Investigation
Search & Analyze
Report Findings

2. Preparation Forensic Analysis Where To Start
Begin by creating a list of search terms that are relevant to your investigation. Prioritize the terms based on importance.
Goal: Search for artifacts relevant to your investigation
Where To Start
Create a list of things you know that are involved in the investigation:
Names of people
Office applications
Domain names
Encryption chat
Project names
addresses
Filenames
Phone numbers
Websites
Credit card numbers
This list can be used to automate locating items in memory:

3. Approach For Investigating A Particular Application
Forensic
Analysis
Preparation (cont.)
Considerations
Try to find objects and artifacts that can tell you:
Who has logged into the computer?
When did things happen?
What processes are running?
What applications are installed?
What file types of files are found?
What are the capabilities of the installed programs?
Approach For Investigating A Particular Application
Know all you can: e.g., Skype:
Google: “Skype”
What is it? How is it used?
Why is the suspect using it?
Is there volatile data in memory that might not be available by performing disk based forensics?

4. Investigating Webmail
Forensic
Analysis
Investigating Webmail
Web Browser Artifacts
-Web sites visited
-Files downloaded
-Memory offsets
WebMail Search Terms
-Locate addresses:
@gmail.com
@hotmail.com
@yahoo.com
@hushmail.com
Attachment
&passwd=
&login=

5. Skype Memory Artifacts
Forensic
Analysis
Investigating Skype
Skype Memory Artifacts
Verify Skype is running via the “Process” list:
Inspect the “Open Files” list
Sort by name
Locate Skype
Identify the Windows username and the Skype username:
C:\Documents and Settings\username\Application Data\Skype\skype username.

6. Locate Unencrypted Chat
Forensic
Analysis
Investigating Skype
Locate Unencrypted Chat
Skype uses the # and $ sign to denote chat conversations. Search for the Skype username with a # and or $ sign preceding the name. Make sure to search for ASCII and Unicode strings.
Make sure to search for ASCII and Unicode strings:
Example chat snippet: