Forensic analysis of memory on Linux
Tracing Clues
In computer forensics, memory analysis is becoming increasingly important as a means for investigating security incidents. In this article, we provide an overview of the various memory dumping options on Linux and introduce the support in Linux for the Volatility Analysis Framework.
Experts agree that one of the first steps for diagnosing a potential intrusion incident is backing up a RAM image. Traditional investigations of persistent memory are no longer sufficient because, as the capacity of hard drives increases, you need to investigate a huge amount of data to detect an attack. Analysis of volatile memory can support and accelerate these investigations because forensic investigators only need to search through a comparatively small amount of data for clues relating to a successful attack. Additionally, RAM often contains important traces, such as information on running processes or active network connections.
Tapping into RAM is especially important for countering anti-forensics techniques. In some cases, it is possible to extract the passphrase for an encrypted drive from volatile memory. You can also detect non-persistent malware using RAM analysis. In targeted attacks, hackers often use malicious code that is only active in memory, and it leaves no data behind on the disk. This type of malware is virtually undetectable without analyzing volatile memory.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
US / Canada
UK / Australia
Direct Download
Read full article as PDF:
Price $2.95
News
-
Purism Launches a Mini PC
The makers of the Librem line of Linux-based laptops have released a mini PC.
-
openSUSE Leap 15.2 Adds AI Machine Learning
With the new release of openSUSE Leap comes some exciting new features, including machine learning.
-
Google’s Nearby Sharing Could Work with Linux
Google’s answer to Apple’s AirDrop feature is rumored to work with the Linux desktop.
-
System76 Launches Ryzen-Powered Laptop
The new System76 Serval WS includes a powerful AMD Ryzen CPU.
-
Linux Mint Drops Snap
Linux Mint has officially dropped their support for Canonical’s snap packages.
-
Lenovo Upping Their Linux Support
Lenovo is now offering full certification and Linux preinstalled hardware.
-
LPI Launches FOSSlife Website
Linux Professional Institute launches FOSSlife, a website for the FOSS community.
-
Tuxedo Computers Joins the Ryzen Bandwagon
Tuxedo Computers has released the Tuxedo Boot BA15 with an AMD Ryzen 3500 CPU.
-
Linux Apps on Windows Is Coming
Linux GUI apps will be coming to Windows Subsystem for Linux.
-
Linux Usage Is on the Rise
According to NetMarketShare, Linux saw a significant bump in usage during April.