Memory Forensics

• This week we are learning about memory forensics!
• Memory forensics involves analysing memory dumps from computers to find information about how the computer has been used
• This may be done by looking at files, logs, processes, etc.

Volatility3

• Our tool of choice for today!
• Open source memory dump analysis framework
• Provides lots of tools for pulling information and data about a computer from the memory dump

Installing

• Make and/or activate your venv
  • python3 -m venv venv && . venv/bin/activate
• Install using pip or build from the github
  • pip install volatility3
  • Volatility3 github

Running

• vol -f <path to memory image> <plugin> <plugin_option>
• Further docs and tutorials

Challenges

• Memory forensics challenges from ctf.afnom.net
  • Grimace's Sauce and Password
• Volatility Labs on cyberdefenders.org
  • CyberDefenders needs a free account to access labs
  • Volatility3 labs
  • Older labs (hints/solutions provided may not be applicable to vol3)