ISSN 2321 3361 © 2019 IJESC Research Article Volume 9 Issue No. 6 Memory Analysis and what Data can be Extracted from Memory Vijaya Lakshmi1, Dr. Neetu Sharma2 M.Tech Scholar1, HOD2 Department of Computer Forensic & Information Security1, Department of Computer Science & Engineering2 Ganga Institute of Technology and Management, Jhajjar Haryana, India Abstract: At present era of digital world, modern criminal investigators face an increasing number of computer-related crimes. This requires the application of digital forensic science. Digital investigation is becoming an increasing concern. Many digital forensic tools are being developed to deal with the challenge of investigating digital crimes. The major challenge that digital forensics practitioners face is the complicated task of acquiring an understanding of the digital data residing in electronic devices. Acquisition of memory from digital system or device is the first step in digital forensics analysis. Before any analysis can be done, we need to acquire the memory in the first place. Acquisition of volatile memory is one of the vital steps of digital forensics process. There are a number of commercial utilities to acquire memory, but there is also a few free and even open source equivalents. In this article, I am going to review some memory acquisition tools that are designed to deploy on a USB stick for quick incident response operations. Currently, this task requires significant experience and background to correctly analyze and aggregate the data that the tools provide from the digital artifacts. Most of the presently available tools, shows their results in text files or tree lists. It is up to the practitioner to mentally capture a global understanding of the state of the device at the time of seizure and find the useful items of evidentiary interest. This research focuses on the application of memory acquisition techniques and tools for the analysis of digital forensic evidence. Finally, a comparison based on total memory acquisition size and time elapsed for acquisition has also been done and presented through a chart. The results provide the necessary details for verifying digital artifacts. As per this paper, I have performed on windows platform only. This can be modified to support various digital forensic target platforms including Mac OS X, Linux, and Android. Keywords: Memory forensic, Memory Imaging, Memory acquisition, Raw memory dump, Incident Response, Digital artifacts. 1. INTRODUCTION Physical memory analysis from Windows systems can provide Memory Analysis is a process & technique of using a ‘memory important information about the target operating system. This image’ to get information about the overall state of a computer, field is still very new, but holds great promise. the programs running on it, the operating system and other digital artifacts and network connectivity etc. Actually Memory 1.1. Memory Imaging Analysis is the domain of Memory forensics, sometimes referred Memory imaging is the process of making a bit-by-bit copy of to as memory analysis that refers to the analysis of volatile data memory. In principle it is similar to Disk Imaging. A ‘memory in a computer’s memory dump. It is forensic analysis of a image’ is simply the view of the current state and components of computer's memory dump. The primary application of memory the systems memory at a certain time. It is something like an analysis is inspecting computer attacks. These attacks are image (or a photocopy) to be able to examine it afterwards. The stealthy enough to avoid leaving data on the computer's hard resulting copy is stored in a ‘Forensics image format’. Some of drive. For this,(RAM) or the memory (whether primary or other these formats have means to differentiate between an image of memory drives and devices) must be analyzed for forensic memory and (e.g.) that of a disk. For physical memory it is information. By performing memory forensics analysis, common to have sections that are not accessible, e.g. because of information security professionals investigate and identify memory-mapped I/O. The physical memory of computers can be attacks or malicious behaviors that do not leave easily detectable imaged and analyzed using a variety of tools. The procedure for tracks on hard drive data. Because the analysis is highly accessing physical memory varies between operating systems, dependent on the operating system, it has been divided into the Hence, there are different tools for different operating systems. following and based on it there are different and versatile Once memory has been imaged, it is subjected to memory memory imaging and memory acquisition tools to perform and analysis to ascertain the state of the system, extract artifacts, and analyze memory to retrieve various types of static and running so on. data. 1.2. Practical Issue One of the most annoying problems for memory imaging is verifying that the image has been created correctly. That is, verifying that it reflects the actual contents of memory at the time of its creation. Because the contents of memory are constantly changing on a running system, the process can be IJESC, June 2019 23058 http://ijesc.org/ repeated but the results will never--to a high degree of WinDbg or by acquiring a memory dump in a Microsoft crash probability--be the same. Thus, repeating the acquisition and dump file format. comparing the results is not a feasible means of validating correct image creation. Memory analysis can reveal whether the 2.2 Some Research Review image's contents are consistent with the known layout and 2.2.1In reference to the research paper by Stephan et al (2011), structure of a given operating system, as well as answering other the authors illustrated the process (figure 1) for extracting the questions, but it cannot answer the question as to whether the graphic content information from the memory dump of windows image accurately reflects the system from which it was taken at based machine (Kiltz, Hoppe, & Dittmann, 2009). In addition, the time it was taken. the authors also developed a forensic model used for this research. The extraction process (figure 1) used by Stephan et al 2. LITERATURE REVIEW (2011) involves strategic preparation, operational preparation, data gathering, data investigation, data analysis, and final 2.1 History and Background documentation with evidence presentation. Zeroth Generation - Before 2004,generic data analysis tools like strings and grep were used and memory forensics was done on an ad hoc basis. These tools are a bit difficult to use as they are not particularly created for memory forensics. They also provide limited information. Generally, their primary usage is to extract the text from the memory dump. There are several other operating systems that provide features to kernel developers and Figure.1.Extraction Process of graphic Content from also to the end-users to create a snapshot of the physical memory memory dump for either purpose of debugging (core dump or Blue Screen of According to the author, forensically relevant data types are Death) or experience enhancement (Hibernation (computing)). hardware data, raw data and details about data, configuration In the case of Microsoft Windows, crash dumps and hibernation data, communication protocol data, process data, session data had been present since Microsoft Windows NT. Microsoft crash and user data. Along with this, the other tools that were used to dumps had always been analyzable by Microsoft WinDbg, and retrieve the graphic content from the memory dump were Irfan Windows hibernation files (hiberfil.sys) are nowadays View and volatility framework (Kiltz et al., 2009). convertible in Microsoft crash dumps using utilities like “MoonSols” (now comes by Comae technologies) Windows 2.3 Recovering Windows registry information from memory Memory Toolkit designed by Matthieu Suiche. dump 1rst Generation -In February 2004, Michael Ford introduced Windows registry is significant area for recovering and memory forensics into security investigations with an article in analyzing potential evidence about each event on a windows Sys Admin Magazine. In that article, he verified analysis of a machine. Shuhui Zhang et al (2011) have proposed a method for memory based root kit. Here its process utilized the existing recovering windows registry information from the memory Linux crash utility along with two tools particularly developed dump using Hive files. As the hive files contain all the necessary for recovery and analysis of the memory forensically, memget data including handles, metadata, objects, keys, data structures and mem peek. DFRWS, in 2005 issued a Memory Analysis and file maps which are potentially significant for forensic Forensics Challenge. In response to the present challenge, memory analysis. Similarly, another paper was written by additional tools during this generation, specifically designed to Farmer et al (n.d.) on forensic analysis of windows registry. The analyze memory dumps, were created. These tools had authors, in this research paper have illustrated forensic analysis information of the in operation system's internal data structures, by directly viewing the windows registry and not analyzing from and were so capable of reconstructing the operating system's the memory dump. The author has analyzed and documented the process list and process information. Although intended as possible evidences that could be recovered from windows research tools, these tools proved that operating system level registry such as: memory forensics is possible and also practical. 2nd Generation - Development of several memory forensics .Registry Hive Locations tools were intended for the practical. These tools include both • MRULists (Most Recently UsedList) the commercial tools like “Memoryze”, “MoonSols” Windows • Wireless Networks details Memory Toolkit, open source tools like “Volatility”. Some new • Network details features were added, such as analysis of Linux and Mac OS X • LAN computer connected through the machine memory dumps, and substantial academic research has been • Portable devices connected carried out.As of now, memory forensics is a standard • Artefacts of IE component of incident response.