Memory forensics: avml and Volatility
Taking a memory dump and examining it with Volatility.
Level 301 · 16 lessons · 15 practice labs
Lessons
Volatile evidence and acquisition
- Volatile evidence and collection order: You will understand that data in memory is lost when a machine powers off, and so in what order evidence must be collected.
- Taking a memory dump with avml: You will learn the purpose and method of taking a memory dump from a running lab machine, and how it affects the system.
- Recording the dump's integrity with sha256sum: You will learn to record a memory dump's fingerprint (hash) and collection details so you can show it was not altered later.
- Capturing memory with the LiME kernel module and comparing with avml
- Short task: capture a server’s memory, hash it and log it
First steps with Volatility
- First look with strings: You will learn to skim the readable text in a memory dump with strings and pick out interesting clues.
- Volatility: image information: You will learn to read with Volatility which operating system a dump comes from, so you can choose the right setup for later analysis.
- Symbol tables for Linux memory: dwarf2json
- Process listing with Volatility: pslist: You will learn to list the processes that were running when the dump was taken with pslist, and to spot an unusual or out-of-place one.
- Process tree and command lines with linux.pstree and linux.psaux
- Short task: find the suspicious shell among child processes
Network, file and shell traces
- Network connections with Volatility: netscan: You will learn to see which network connections were open at dump time with netscan, and to pick out suspicious remote addresses.
- Correlating a process with a connection in Volatility: You will learn to match each process with the network connection it made, bringing the story of suspicious behaviour into one table.
- Command history in memory with linux.bash
- Open files and memory regions with linux.lsof and proc.Maps
- Capstone: an incident summary from a memory dump with Volatility: Capstone: you examine a fictional company's memory dump, find the suspicious process and its connection, and write the findings in a short incident summary.
Practice labs
- Hash and record a memory dump: Take the SHA-256 hash of a prepared memory dump and write it into the acquisition record with time and tool.
- Take memory from the lab server with avml: Take a dump with avml on the lab server, compare its size with physical memory and hash it.
- Compare LiME with avml: Compare prepared dumps taken with the two tools on size, format and footprint left on the system.
- A first look with strings: Search the dump for IP addresses and URLs with strings and grep.
- Extract image info and kernel version: Determine the dump's kernel version with Volatility and show the right symbol table is loaded.
- Produce a symbol table with dwarf2json: Produce a symbol table from the given kernel debug file and prove the dump now parses.
- Produce the process list: List the processes in the dump with their start times using pslist.
- Find the suspicious shell in the process tree: Find the shell spawned by the web server process and its command line with pstree and psaux.
- Order the incident from command lines: Arrange the suspicious processes' command lines by start time and tell what was done in five steps.
- List the network connections in memory: List the open connections and listening ports in the dump.
- Tie a connection to a process: Find which process owns the outbound connection and that process's parent.
- Recover the command history from memory: Extract the in-memory command history with linux.bash and mark the commands erased from disk.
- List a process's open files: Extract the suspicious process's open files and sockets with linux.lsof.
- Inspect the memory regions: List the process's regions with proc.Maps and mark the executable region with no backing file.
- An incident summary from a memory dump: Combine process, connection and command findings from Demirsu Enerji's prepared server dump into a one-page summary.
About this course
Taking a memory dump and examining it with Volatility.
What you will learn
- Volatile evidence and acquisition
- First steps with Volatility
- Network, file and shell traces
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.