How do you handle volatile evidence like memory dumps?

1 Acquire memory dumps quickly

The first step in handling volatile evidence is to acquire it as soon as possible after detecting an incident. The longer you wait, the more likely the memory will change, overwrite, or be erased by the system or the attacker. You should use a trusted and tested tool that can capture the entire memory or a specific region of interest, depending on the scope and nature of the incident. Some examples of memory acquisition tools are FTK Imager, DumpIt, WinPMEM, and LiME. You should also document the acquisition process, including the tool name, version, hash, date, time, and command line options.

2 Analyze memory dumps offline

The second step is to analyze the memory dumps offline, using a separate system and a copy of the original dump file. This way, you can avoid altering or compromising the evidence, and you can also perform multiple analyses with different tools and techniques. You should verify the integrity of the copy by comparing its hash value with the original. You should also use a tool that can parse and interpret the memory dump according to the operating system, architecture, and format of the source system. Some examples of memory analysis tools are Volatility, Rekall, Redline, and Mandiant Memoryze.

3 Extract relevant artifacts

The third step is to extract relevant artifacts from the memory dump that can help you understand the incident, identify the root cause, determine the impact, and remediate the threat. Depending on the type and goal of your analysis, you may want to look for different artifacts, such as process information, network activity, registry keys, file handles, DLLs, strings, malware indicators, or user data. You should use a tool that can automate the extraction and presentation of these artifacts, as well as allow you to filter, search, and correlate them. Some examples of artifact extraction tools are Volatility plugins, Rekall plugins, and Redline collectors.

4 Preserve memory dumps securely

The fourth step is to preserve the memory dumps securely, in case you need to revisit them later or present them as evidence in a legal or regulatory context. You should store the memory dumps in a safe and controlled location, such as an encrypted drive or a cloud storage service. You should also maintain a chain of custody record that documents the history and handling of the evidence, including who created, accessed, modified, or transferred it, and when and why. You should also follow any applicable standards or guidelines for evidence preservation, such as ISO 27037 or NIST 800-86.

5 Report memory dump findings

The fifth step is to report the findings from the memory dump analysis to the relevant stakeholders, such as management, security team, legal team, or external partners. You should summarize the key facts and insights from the analysis, such as what happened, how it happened, who was involved, what was affected, and what actions were taken or recommended. You should also provide supporting evidence, such as screenshots, tables, graphs, or logs, that illustrate your findings and conclusions. You should also use clear and concise language, avoid technical jargon, and address any questions or concerns that may arise from the report.

6 Update memory dump skills

The sixth step is to update your skills and knowledge on memory dump acquisition and analysis, as this is a dynamic and evolving field that requires constant learning and improvement. You should keep up with the latest developments and trends in memory forensics, such as new tools, techniques, formats, or challenges. You should also practice your skills on realistic scenarios, such as memory dump challenges, CTFs, or labs. You should also seek feedback and guidance from other experts or peers in the field, such as mentors, instructors, or online communities.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?