Memory forensics

Memory forensics is forensic analysis of a computer's memory dump. It's primary application is investigation of advanced computer attacks which are stealthy enough to avoid leaving data on the computer's hard drive. Consequently, the memory (RAM) must be analyzed for forensic information.

History

Zeroth generation tools

Prior to 2005, memory forensics was done on an ad-hoc basis, using generic data analysis tools like strings and grep. These tools are not specifically created for memory forensics, and therefore are difficult to use. They also provide limited information. In general, their primary usage is to extract text from the memory dump.

First generation tools

In 2005, DFRWS issued a Memory Analysis Forensics Challenge.. In response to this challenge, a new generation of tools, specifically designed to analyze memory dumps, was created. These tools had knowledge of the operating system's internal data structures, and were thus capable of reconstructing the operating system's process list and process information.

Although intended as research tools, they proved that operating system level memory forensics is possible and practical.

Second generation tools

Subsequently, several memory forensics tools were developed intended for practical use. These include both commercial tools like Memoryze and open source tools like Volatility. New features have been added, such as analysis of Linux and Mac OS X memory dumps, and substantial academic research has been carried out.

Currently, memory forensics is a standard component of incident response.