Memory Forensics

What is memory forensics?

Memory forensics, also known as memory analysis, is a type of digital investigation that reviews a device for evidence of malicious software or evidence of a cyber attack.

To dive into a device’s system memory, digital forensics software is used to create a snapshot, or memory dump, of the random access memory (RAM) data for analysis. This volatile data is temporary and disappears once the device is powered off. For this reason, a memory dump is the best way to retain permanent access to this information for conducting the investigation.

Once retrieved, memory forensic investigators take the data offsite and evaluate it for suspicious activity that may not be apparent in hard drive data alone. Information found during analysis can give valuable runtime insights into the system’s status before the security was compromised. From there, they determine their next steps.

Types of memory forensics

While memory forensics is one type of investigation technique, it can support several acquisition formats. These include:

• RAW format. When malicious activity is suspected early enough, possibly through threat hunting approaches, investigators can capture a data snapshot directly from the device’s live environment for analysis. This is the most commonly used format in memory forensics.
• Crash dump. If a device crashes, its volatile data is at risk of being lost, but some digital forensics tools can recover this information from the operating system (OS) afterward.
• Hibernation files. When a device powers down into hibernation mode, some RAM contents are saved for the next time the device is powered back on. A hibernation file of this information is created, meaning investigators can pull the contents of this memory dump from the OS.
• Page files. These types of files are stored in the system RAM and can be copied to review at a later time.
• VMWare snapshots. For devices like virtual machines – the “VM” in VMWare – a snapshot of a specific moment can be used in memory analysis. Investigators will catch the device’s exact status at the moment of the snapshot.

Basic elements of memory forensics

The process of memory forensics is broken down into the following distinct stages.

• Memory acquisition is the phase of data collection from the device. A copy of the RAM is made using digital forensics software, which has access to the device’s operating system and hardware. The team creates a RAW memory snapshot for analysis. Several snapshots may be taken for timestamped comparisons during the investigation.
• Memory analysis is the process of reviewing the snapshot file and looking for potential issues. Every investigator works differently, but common steps in the analysis are scanning for malware signatures, extracting files from various parts of the system, and recovering data that may have been temporarily lost.

Benefits of memory forensics

Cybersecurity is an ongoing effort that businesses always have to consider. Memory analysis can be both a proactive and reactive approach, with benefits that include:

• Pinpointing hard-to-detect malware. Cybercriminals become more sophisticated every day and learn how to evade common firewalls and other security systems. Once they have access to a device’s RAM, most systems can’t detect them. Any organization or individual they target is at risk. Memory forensics clears the way for a deep dig to root out malware at the heart of the operating system.
• Providing evidence of real attacks. Dealing with a cyber attack is challenging, but having evidence of a coordinated attack helps petition for additional security staff or resources. The evidence found through memory forensics can be proof that extra support is needed to protect the company from additional attacks.
• Getting ahead of future threats. Even though it focuses on investigating incidents that have already happened, forensic analysis can be used to prevent further attacks. If benign system anomalies are found during a memory dump, IT teams can create patches for bugs before they become exploited vulnerabilities.

Best practices for memory forensics

Investigators can reveal many important pieces of information thanks to memory forensics. To ensure a successful investigation, teams should:

• Plan ahead of time. Having a clear objective and scope to the investigation makes results clearer and more accurate. Especially if the investigation is reacting to a suspected threat, a detailed list of tasks and steps can save time and find issues more quickly so action can be taken to remove the threat. 
• Document all steps. All actions, tasks, tools, and individuals responsible should be noted during a forensics investigation. Not only does this keep the team on track, but it can also be referred to later if additional problems arise.
• Validate results. Once evidence is collected, validate findings against other investigations and take a secondary look at results by team members who didn’t gather the initial data. This can confirm the accuracy of results, along with providing reliability. Consistency is crucial in memory forensics, as this evidence may be compared to future investigations.

Continually monitor for possible cyber threats and keep your organization safe with attack surface management software.