Memory Forensics Research Articles

A FRAMEWORK TO ANALYZE OS SYSTEMS ARTIFACTS FROM LINUX MACHINES

Memory forensics plays a pivotal role in digital investigations, providing crucial insights into the activities and artifacts of an operating system. This paper explores the application of deep learning techniques in the domain of memory forensics within the Linux environment. Linux-based systems are widely used in various contexts, including servers, embedded devices, and desktops, making memory analysis in this ecosystem of paramount importance. Traditional memory forensics techniques have relied on manual analysis, which is often time-consuming and error prone. Deep learning, a subfield of machine learning, has demonstrated remarkable capabilities in pattern recognition and feature extraction tasks. In response, this paper presents a novel framework that automates and improves memory analysis through deep learning. Key components of this framework include data collection, preprocessing, feature extraction, and model selection. We introduce a unique dataset specifically curated for Linux memory forensics, facilitating the development and evaluation of deep learning models. Our experimental results demonstrate the efficacy of using a ResNet-50 model for detecting and classifying malware from memory dumps, achieving a detection rate of 98.75% and an accuracy rate of 89% in classifying malware types. Additionally, we acknowledged the challenges and limitations of applying deep learning in memory forensics, such as model interpretability and data privacy concerns. Future research directions are discussed, including real-time memory analysis integration and techniques for handling encrypted and compressed memory data.

Decoding digital interactions: An extensive study of TeamViewer's Forensic Artifacts across Windows and android platforms

The pervasive influence of digital technology has ushered in a new era of connectivity, reshaping the landscape of forensic science and challenging investigators to adapt to evolving methods of digital interaction. Remote access applications (RAAs) like TeamViewer have become integral tools for facilitating remote collaboration and support across various platforms. However, the widespread adoption of such applications has also led to an increase in cybercrimes, underscoring the critical need for meticulous forensic analysis. This study presents a comprehensive examination of TeamViewer's forensic artifacts across Windows and Android platforms, employing advanced forensic techniques such as registry analysis, disk forensics, memory forensics, and Android forensics. By meticulously dissecting digital evidence and uncovering valuable insights into user interactions, configuration settings, and session dynamics, this research aims to enhance understanding of remote access activities and empower forensic investigators with the tools needed to combat cybercrimes effectively. The findings highlight the forensic significance of each investigative approach and underscore the importance of continuous innovation in the field of digital forensics.

Towards a unified XAI-based framework for digital forensic investigations

Explainable Artificial Intelligence (XAI) aims to alleviate the black-box AI conundrum in the field of Digital Forensics (DF) (and others) by providing layman-interpretable explanations to predictions made by AI models. It also handles the increasing volumes of forensic images that are impossible to investigate via manual methods; or even automated forensic tools. A holistic, generalized, yet exhaustive framework detailing the workflow of XAI for DF is proposed for standardization. A case study examining the implementation of the framework in a network forensics investigative scenario is presented for demonstration. In addition, the XAI-DF project lays the basis for a collaborative effort from the forensics community, aimed at creating an open-source forensic database that may be employed to train AI models for the digital forensics domain. As an onset contribution to the project, we create a memory forensics database of 27 memory dumps (Windows 7, 10, and 11) simulating malware activity and extracting relevant features (specific to processes, injected code, network connections, API hooks, and process privileges) that may be used for training, testing, and validating AI models in keeping with the XAI-DF framework.

Volatile data acquisition and analysis by using Memory Forensics techniques

Memory forensics is a vital component of digital investigations, involving the analysis of volatile memory (RAM) in computer systems to gather evidence, identify malicious activities, and reconstruct cybercrime incidents. This paper provides an overview of memory forensics, highlighting its definition, importance, purpose, and scope. It explores the evolution and significance of memory forensics in response to increasingly complex cyber threats. The memory forensics process is discussed, covering memory acquisition and analysis. Legal and ethical considerations related to the admissibility of memory evidence and privacy protection are examined. The paper also discusses the types of memory, including physical and virtual memory, and their characteristics and significance in memory forensics. Furthermore, it explores the memory acquisition process, different methods, tools, and techniques used, as well as the importance of preserving evidence integrity. Finally, the paper introduces various tools for memory analysis, such as Volatility, Volatility Workbench, FTK Imager, Encase, Hibernation Recon, and Xplico, and highlights their role in extracting valuable evidence from memory dumps.

Live Memory Forensic: Capture and Analyzing Volatile Data

As almost 90% of malware is resident in memory, live memory forensics is an essential part of cybersecurity. Live memory forensics refers to the process of analyzing computer RAM or volatile memory (which is lost after rebooting) while the computer is running. This article provides depth on live memory forensics, which is key in the detection and analysis of cyber threats and forensics investigations. Case studies and actual events demonstrate how this method can detect unauthorized access and discover hidden malware, which will help law enforcement investigators. The practical uses of Live Memory Forensics are illustrated using real world examples. Currently, live memory forensics are faced with the temporal nature of volatile data, other technical challenges, the instantiation of indirect data related to data privacy, and evidence handling problems. The paper emphasizes the importance of moral attitude and careful handling of data to keep the forensic process incorrupt. Investigators and cybersecurity professionals should now have a good understanding of live memory forensics and how to utilize live memory forensics to enhance security across borders, not just as a detective technique.

Enhancing the Security of Software-Defined Networking through Forensic Memory Analysis

Enhancing the Security of Software-Defined Networking through Forensic Memory Analysis

ProcGCN: detecting malicious process in memory based on DGCNN.

The combination of memory forensics and deep learning for malware detection has achieved certain progress, but most existing methods convert process dump to images for classification, which is still based on process byte feature classification. After the malware is loaded into memory, the original byte features will change. Compared with byte features, function call features can represent the behaviors of malware more robustly. Therefore, this article proposes the ProcGCN model, a deep learning model based on DGCNN (Deep Graph Convolutional Neural Network), to detect malicious processes in memory images. First, the process dump is extracted from the whole system memory image; then, the Function Call Graph (FCG) of the process is extracted, and feature vectors for the function node in the FCG are generated based on the word bag model; finally, the FCG is input to the ProcGCN model for classification and detection. Using a public dataset for experiments, the ProcGCN model achieved an accuracy of 98.44% and an F1 score of 0.9828. It shows a better result than the existing deep learning methods based on static features, and its detection speed is faster, which demonstrates the effectiveness of the method based on function call features and graph representation learning in memory forensics.

A Comprehensive Literature Review on Volatile Memory Forensics

Through a systematic literature review, which is considered the most comprehensive way to analyze the field of memory forensics, this paper investigates its development through past and current methodologies, as well as future trends. This paper systematically starts with an introduction to the key issues and a notable agenda of the research questions. Appropriate inclusion and exclusion criteria were then developed, and a deliberate search strategy was adopted to identify primary research studies aligned with the research question. The paper goes into specific details of six different memory categories, notably volatile memory, interpreting their advantages and the tactics used to retrieve the data. A detailed comparison with existing reviews and other relevant papers is made, forming a broader and wider picture of the research. The discussion summarizes the main findings, particularly the rise of more complex and advanced cyber threats and the necessity of more effective forensic methods for their investigation. This review pinpoints the possibilities for future study with the purpose of staying ahead in the evolving technological landscape. This overview is undoubtedly an essential resource for professionals and researchers working in digital forensics. It allows them to stay competent and provides enough insight into the current trends while marking the future direction in digital forensics methodology.

VolGPT: Evaluation on triaging ransomware process in memory forensics with Large Language Model

In the face of the harm that ransomware can inflict upon users’ computers, the imperative to efficiently and accurately triage its processes within memory forensics becomes increasingly crucial. However, ransomware perpetrators employ sophisticated techniques, such as process masquerading, to evade detection and analysis. In response to these challenges, we propose a novel ransomware triage method leveraging a Large Language Model (LLM) in conjunction with the Volatility framework, the de-facto standard in memory forensics. We conducted experiments on memory dumps infected by five different ransomware families, utilizing LLM-based approaches. Through extensive experiments, our method named volGPT demonstrated high accuracy in identifying ransomware-related processes within memory dumps. Additionally, our approach exhibited greater efficiency and provided more comprehensive explanations during ransomware triage than other state-of-the-art methods.

A step in a new direction: NVIDIA GPU kernel driver memory forensics

In the ever-expanding landscape of computation, graphics processing units have become one of the most essential types of devices for personal and commercial needs. Nearly all modern computers have one or more dedicated GPUs due to advancements in artificial intelligence, high-performance computing, 3D graphics rendering, and the growing demand for enhanced gaming experiences. As the GPU industry continues to grow, forensic investigations will need to incorporate these devices, given that they have large amounts of VRAM, computing power, and are used to process highly sensitive data. Past research has also shown that malware can hide its payloads within these devices and out of the view of traditional memory forensics. While memory forensics research aims to address the critical threat of memory-only malware, no current work focuses on video memory malware and the malicious use of the GPU. Our work investigates the largest GPU manufacturer, NVIDIA, by examining the newly released open-source GPU kernel modules for the development of forensic tool creation. We extend our impact by creating symbol mappings between open and closed-source NVIDIA software that enables researchers to develop tools for both “flavors” of software. We specifically focus our research on artifacts found in RAM, providing the foundational methods to detect and map NVIDIA Object Compiler Structures for forensic investigations. As a part of our analysis and evaluation, we examined the similarities between open-and-closed kernel modules by collecting structure sizes and class IDs to understand the similarities and differences. A standalone tool, NVSYMMAP, and Volatility plugins were created with this foundation to automate this process and provide forensic investigators with knowledge involving processes that utilized the GPU.

On enhancing memory forensics with FAME: Framework for advanced monitoring and execution

Memory Forensics (MF) is an essential aspect of digital investigations, but practitioners often face time-consuming challenges when using popular tools like the Volatility Framework (VF). VF, a widely-adopted Python-based memory forensics tool, presents difficulties for practitioners due to its slow performance. Thus, in this study, we evaluated methods to accelerate VF without modifying its code by testing four alternative Python Just In Time (JIT) interpreters - CPython, Pyston, PyPy, and Pyjion - using CPython as our baseline. Tests were conducted on 14 memory samples, totaling 173 GB, using a search-intensive VF plugin for Windows hosts. Employing our custom Framework for Advanced Monitoring and Execution (FAME), we deployed interpreters in Docker containers and monitored their real-time performance. A statistically significant difference was observed between the Python JIT interpreters and the standard interpreter. With PyPy emerging as the best interpreter, yielding a 15–20 % performance increase compared to the standard interpreter. Implementing PyPy has the potential to save significant time (many hours) when processing substantial memory samples. FAME enhances the efficiency of deploying and monitoring robust forensic tool testing, fostering reproducible research and yielding reliable results in both MF and the broader field of digital forensics.

TLS key material identification and extraction in memory: Current state and future challenges

Memory forensics is a crucial part of digital forensics as it can be used to extract valuable information such as running processes, network connections, and encryption keys from memory. The last is especially important when considering the widely used Transport Layer Security (TLS) protocol used to secure internet communication, thus hampering network traffic analysis. Particularly in the context of cybercrime investigations (such as malware analysis), it is therefore paramount for investigators to decrypt TLS traffic. This can provide vital insights into the methods and strategies employed by attackers. For this purpose, it is first and foremost necessary to identify and extract the corresponding TLS key material in memory.In this paper, we systematize and evaluate the current state of techniques, tools, and methodologies for identifying and extracting TLS key material in memory. We consider solutions from academia but also identify innovative and promising approaches used “in the wild” that are not considered by the academic literature. Furthermore, we identify the open research challenges and opportunities for future research in this domain. Our work provides a profound foundation for future research in this crucial area.

Advanced Volatile Memory Forensics through Autopsy Integration

The main goal of this study is to design a novel plugin for the Autopsy forensic framework to enable forensic analysts to identify and extract volatile memory from small-scale digital devices. This includes network peripherals and Internet of Things devices, smartphones, and industrial-control systems. Given the importance of volatile memory to digital crime and cybersecurity investigations, an accurate and reliable tool is needed to non-destructively acquire forensic copies of the evidence. In the context of small-scale devices, this study is of acute importance to bridge the gap that exists in current forensic research and forensic practice, using separate tools can be challenging due to compatibility issues and the complexity of managing multiple system. In conclusion, the developed Autopsy plugin, which has been termed the MemoryIntegrator, seamlessly harmonizes with Autopsy forensic framework and is designed to work together with Volatility tool, specializing in detailed memory analysis. Consequently, the following main outcomes result from the experimentation and application of the plugin: Promotes the default forensic activity of Autopsy by providing the analysts with a way to swiftly and directly harvest and evaluate volatile data from diverse small scale digital devices. The implementation of the plugin ensures that the integrity of the memory data is maintained throughout the extraction and analysis process. This is facilitated by cryptographic hash validations that confirm that there are no changes in the data from the extraction to the point of analysis. The plugin maintains the integrity of the memory data from the time of extraction to the time of analysis using cryptographic hash validations which verifies that these data has not been manipulated at this point. MemoryIntegrator outmatched all the forensic tools herewith because conducting forensic test back at home verified its superiority in terms of the extraction of data from memory speed and the authenticity and formula which it uses in analysis. In the modern world, this is critical to investigate digital crimes and incidences that affect cybersecurity.

DICEguard: enhancing DICE security for IoT devices with periodic memory forensics

The number of Internet-of-Things (IoT) devices has been increasing rapidly every year. Most of these devices have access to important personal data such as health, daily activities, location, and finance. However, these devices have security problems since they have limited processing power and memory to implement complex security measures. Therefore, they possess weak authentication mechanisms and a lack of encryption. Additionally, there are no widely accepted standards for IoT security. Device Identifier Composition Engine (DICE) was proposed as a standard that enables adding a security layer to low-cost microcontrollers with minimal silicon overhead. However, previous studies show that DICE-based attestation is vulnerable to some remote attacks. In this study, we present a novel method called DICEguard to address the security problems of DICE. One of the key innovations of DICEguard is its incorporation of periodic memory forensics (PMF) technique, leveraging a hardware-based hash engine to detect and mitigate potential security breaches resulting from firmware vulnerabilities. DICEguard enhances the overall resilience of IoT devices against attacks by swiftly detecting alterations indicative of malicious activity through periodic calculation and comparison of firmware digests. Furthermore, DICEguard introduces a one-time programmable (OTP) memory component to safeguard critical security parameters, such as public keys used for signature verification, against tampering by adversaries. This ensures the integrity of essential security measures even in the face of sophisticated attacks. We implemented the enhanced DICE architecture using the open-source RISC-V platform Ibex and the mbedTLS library for cryptographic operations. We performed the hash operations required by DICE in a hardware-based manner on a commercial Field Programmable Gate Array (FPGA) platform rather than firmware, which is more vulnerable to attacks. Our test results show that with negligible area overhead to a standard microcontroller system, the proposed method can detect the simulated attacks.

Volatile Data Acquisition and Analysis by Using Memory Forensics Techniques

Memory forensics is a vital component of digital investigations, involving the analysis of volatile memory (RAM) in computer systems to gather evidence, identify malicious activities, and reconstruct cybercrime incidents. This paper provides an overview of memory forensics, highlighting its defini-tion, importance, purpose, and scope. It explores the evolution and significance of memory forensics in response to increasingly complex cyber threats. The memory forensics process is discussed, cover-ing memory acquisition and analysis. Legal and ethical considerations related to the admissibility of memory evidence and privacy protection are examined. The paper also discusses the types of memory, including physical and virtual memory, and their characteristics and significance in memory forensics. Furthermore, it explores the memory acquisition process, different methods, tools, and techniques used, as well as the importance of preserving evidence integrity. Finally, the paper introduces various tools for memory analysis, such as Volatility, Volatility Workbench, FTK Imager, Encase, Hibernation Recon, and Xplico, and highlights their role in extracting valuable evidence from memory dumps.

DFRWS EU 10-year review and future directions in Digital Forensic Research

Conducting a systematic literature review and comprehensive analysis, this paper surveys all 135 peer-reviewed articles published at the Digital Forensics Research Conference Europe (DFRWS EU) spanning the decade since its inaugural running (2014–2023). This comprehensive study of DFRWS EU articles encompasses sub-disciplines such as digital forensic science, device forensics, techniques and fundamentals, artefact forensics, multimedia forensics, memory forensics, and network forensics. Quantitative analysis of the articles’ co-authorships, geographical spread and citation metrics are outlined. The analysis presented offers insights into the evolution of digital forensic research efforts over these ten years and informs some identified future research directions.

Intra- and inter-sector contextual information fusion with joint self-attention for file fragment classification

File fragment classification (FFC) aims to identify the file type of file fragments in memory sectors, which is of great importance in memory forensics and information security. Existing works focused on processing the bytes within sectors separately and ignoring contextual information between adjacent sectors. In this paper, we introduce a joint self-attention network (JSANet) for FFC to learn intra-sector local features and inter-sector contextual features. Specifically, we propose an end-to-end network with the byte, channel, and sector self-attention modules. Byte self-attention adaptively recognizes the intra-sector significant bytes, and channel self-attention re-calibrates the features between channels. Based on the insight that adjacent memory sectors are most likely to store a file fragment, sector self-attention leverages contextual information in neighboring sectors to enhance inter-sector feature representation. Extensive experiments on seven FFC benchmarks show the superiority of our method compared with state-of-the-art methods. Moreover, we construct VFF-16, a variable-length file fragment dataset to reflect file fragmentation. Integrated with sector self-attention, our method improves accuracy by more than 16.3% against the baseline on VFF-16, and the runtime achieves 5.1 s/GB with GPU acceleration. In addition, we extend our model to malware detection and show its applicability.

The effects of document's format, size, and storage media on memory forensics

Main memory or RAM contains volatile but critical data about the system's state and its recent activities. Often, RAM based artifacts are hard to be found elsewhere. Digital investigators can find in this volatile data an essential information about the recent usage of a system including the used documents. Nowadays, documents are often fetched from a variety of storage media, most of which are internet based. This can complicate the digital investigation process due to the remote nature of these storage media; most of these remote files cannot be traced on the local hard disk drive (HDD) of the captured machine. However, whenever the document's contents are successfully recovered from RAM images, it can ensure the actual usage of the document. This paper studies the effects of various storage media (local and remote) on the amount of volatile artifacts of different types of documents. Experiments are designed to evaluate the effects of local hard drives, removable media, and a set of cloud based platforms such as Dropbox, Google Drive, and OneDrive on the RAM based artifacts of a used document. Results show that the recovered contents are significantly affected by the used storage media. Moreover, the document's type has an effect too. Frequently, a good ratio of the document's contents are recovered from RAM even when the document is living on the cloud, the document is closed, and the connection is terminated.

Enhancing Reliability During Physical Memory Forensics: Strategies and Practices

Enhancing Reliability During Physical Memory Forensics: Strategies and Practices

An Experimental Assessment of Inconsistencies in Memory Forensics

Memory forensics is concerned with the acquisition and analysis of copies of volatile memory (memory dumps). Based on an empirical assessment of observable inconsistencies in 360 memory dumps of a running Linux system, we confirm a state of overwhelming inconsistency in memory forensics: almost a third of these dumps had an empty process list and was therefore obviously incomplete. Out of those dumps that were analyzable, almost every second dump showed some form of inconsistency that potentially impacts the interpretation of the dump in a forensic investigation. These results are based on a new way to estimate the level of causal consistency of a memory dump. The factors influencing these inconsistencies are less clear but in general correlate with the level of concurrency (system load and number of threads).