Study on Forensic Analysis of Physical Memory

Liming Cai, J ing Sha ,Wei Qian

Key Laboratory of Information Network Security, Ministry of Public Security,
Peoples Republic of China The 3rd Research Institute of Ministry of Public Security. Shanghai, China
{cailiming, shajing, qianwei}@stars.org.cn


AbstractIn this paper we firstly describe the importance of
the study on forensics analysis of physical memory. Further we
introduce some tools and techniques commonly used in
forensics analysis of physical memory. Lastly we present an
example of forensic analysis to illustrate how to do physical
memory forensics and analysis in a windows system by using
existing tools.
Keywords- computer forensics; physical memory forensic;
physical memory analysis
I. INTRODUCTION
As the development of computer technology, computer
crime has become an increasing problem. In such
circumstance, more and more attention has been paid on the
computer forensic. Analyzing systemmemory for artifacts is
a technique of computer forensic used by forensic analysts,
security specialists and those that analyze malware.
Since a considerable part of the computer crime evidence
can not be extraction from permanent storage medium such
as system's hard disk. We must access the computer system's
physical memory to find more important information, such
as the intruder's IP address, information about the running
malicious programs processes, worms, trojans and so on.
We also could extract some sensitive information frome-
mail and instant messaging tools through the analysis of the
dumped physical memory. But once computer system is
turned off, all these information will be lost. Therefore, the
research on forensics and analysis of physical memory has
practical significance on the promotion of the development
of computer forensics technology.
Foreign research on the computer's physical memory
forensic began in 2005. However, the study in this field in
our country is still very weak. And so far very few domestic
research papers about forensics analysis of physical memory
were published.
In this paper we will introduce the key technology of
physical memory forensics and some common software and
hardware tools used in physical memory forensics. Then we
will describes how to obtain a complete copy of system
memory froma live computer using program Dumplt, and
how to analyze this memory dump with the popular memory
analysis tool Volatility. Finally, we will present some
problems and further work about the current research of
physical memory forensics.
II. TOOLS AND TECHNIQUES ABOUT FORENSICS
ANALYSIS OF PHYSICAL MEMORY
A lot of information on computer such as the system
process, network information, login information, registry
information and so on must be accessed by obtaining and
analyzing the target computers physical memory dump. In
this section we will introduce some tools and techniques
commonly used in forensics analysis of physical memory to
find the important information.
The key technology of forensics analysis of physical
memory mainly includes two aspects: acquisition of physical
memory and analysis of collected physical memory. That is
to say, firstly how to obtain physical memory and generate
physical memory image file; secondly how to find out
important evidence through the analysis of physical memory
image file.
A. Acquisition of physical memory
There are two approaches to acquire physical memory
images: hardware based tools and software based tools.
1) Hardware based tools: The hardware based approach
is to bypass the operating systemby means of a physical
device. The dedicated hardware will open a dedicated
communication port to copy the contents of the physical
memory.
One is a dedicated PCI card named Tribble, which
requires installation before incident occurrence. The card can
easily be detached after the incident. In this way the state of
the system is preserved to search for digital evidence. The
advantage of this approach is the ease of use and the null
impact on the system. The biggest disadvantage of this
approach is that the hardware must be pre-installed. So the
device cant yet be widely used.
Another is FireWire bus, also known as IEEE 1394 bus.
Investigators can obtain the systems physical memory
mirroring by utilizing the special properties of FireWire
device. FireWire devices with the technology of direct
memory access (DMA) can directly access the system
memory without CPU. The advantage of this approach is the
FireWire port is a popular port present in many systems. And
the data transfer speed is very fast through FireWire port.
The disadvantage of this approach is the generation of
physical memory mirroring may cause system crash or lose
some information in memory.
2) Software based tools: There are several software
tools used in obtaining physical memory image. Here we
will introduce two commonly used software tools.
2nd International Symposium on Computer, Communication, Control and Automation (3CA 2013)
2013. The authors - Published by Atlantis Press 221


Data Dumper (DD) is the most commonly used software
tools in UNIX system. It can be used in copying files or
creating images. GMG System has released a free download
forensic acquisition tool bag so that it can run on Windows
system and generate the systems physical memory dump.
DumpIt is a compact portable tool which makes it easy to
save the contents of PC's physical memory. It's a console
utility, but there's no need to open a command line, or master
a host of cryptic command line switches. Instead, all you do
is double-click the program's executable, press "Y" to
confirmthat you're "sure you want to continue". And that's it,
DumpIt will save the contents of RAM to a file in DumpIt's
current folder. We will use this tool in the following example.
B. Analysis of physical memory
The next work is to analyze the obtained physical
memory dump. We should extract useful evidence in the
memory dump. Commonly, we could extract the following
information in the memory dump.
processes running in memory
loaded module and DLL, including implanted
malicious programs
systems registry information
The information listed above is most commonly
concerned by forensic investigators. Of course, we also could
analyze other data in the memory dump to get other
information. In next section we will present an example of
forensic analysis of physical memory to illustrate how to
acquire the information listed above by using existing tools.
III. EXAMPLE OF FORENSIC ANALYSIS
A. Obtaining a memory dump with DumpIt
Simply download DumpIt [6], put it onto a USB drive or
save it on your hard drive, double click it, select yes. And
then we obtain a complete copy of machines memory (See
Figure 1). The file extension of the image file generated by
DumpIt is *raw.
The only thing we need to notice is that it is large enough
to hold the file that is created if using a USB drive. The
memory dump will be a little larger than the size of your
installed RAM.

Figure 1. Creating a memory dump file with DumpIt
B. Analyzing a memory image with Volatility
Once we have the memory dump saved, we can now
analyze it with Volatility[7]. First, we should view the
summary information of the memory dump obtained by
using imaginfo command. Specifically, this command can
display the host operating systemversion, service packs and
hardware architecture (32-bit or 64-bit) and the time of the
generation of the memory dump and other basic
information(See Figure 2). For now, we just need to know
the profile type of the memory dump, in this case
Win7SP1x64. We will use this in the next few steps.

Figure 2. Execution of imaginfo command
1) Analyzing process list. Now lets take a look at
recovering a list of the running processes and active network
connections from the captured memory file. Using
Volatilitys pslist command can be used to view the
processes that were running on the Windows system

Figure 3. Execution of pslist command
Fromthe output of the command (See Figure 3), we see
the physical memory location, process name and the PID
number of all process that were running.
But pslist command is not able to detect hidden processes
in memory and process information disappeared in process
list as the system is attacked. Psscan command can solve this
problem. Psscan command can list all processes in system
through the technology of memory pool tag finding. This
command is not only able to display the current active
process information in memory, but also is able to display
222


terminated process and hidden process. And it is the hidden
process in memory forensics has important reference value.

Figure 4. Execution of psscan command

Figure 5. Output of psscan command
Part of the results after running psscan command showed
in Figure 5. We can discover what actions users have done
by analyzing the condition of three running process which
are underlined in Figure 5. User opened the chrome browser
at 2013-9-16 11:33:06. After 2 seconds the user opened the
chrome browser again at 2013-9-16 11:33:08. The user
closed the chrome browser at 2013-9-16 12:44:25. User ran
the process of MOM.exe at 2013-9-16 11:08:25. The process
has been running since the moment of obtaining the memory
mirroring. And the process ID is 3164.
2) Analyzing information of DLL. What is MOM.exe? Is
it a virus program? Now we may view DLL files loaded in
the specified process and then learn more about what the
procedure MOM.exe is.
We could view information of DLL in memory by dlllist
command. If we only need to look at loaded DLL files of a
specific process instead of all processes, we can use p PID
option to filter the output.

Figure 6. Execution of dlllist command
From the output of the command (See Figure 6), we can
see the path of the program MOM.exe and all the loaded
DLL files with its base address when the process is running.
Now we could determine the program MOM.exe is not a
virus program. It is normally just a part of a programcalled
the ATI Catalyst Control Center. We could know more about
the running process or do more another analysis by executing
dlllist command.

3) Analyzing registry keys. Registry plays a very
important role in configuration and control of a computers
operating system. It is primarily used to store the
configuration information of the operating system and users
application. Registry is not a simple large file, but a
collection. Registry file mainly include two categories, the
first category stores static data on the disk. Such registry
files are generally stored in the operating system
system32\config folder. Second category stores volatile
registry data. Such registry file is the data in RAM
maintained by the Windows kernel which will be created at
every system startup time .

Figure 7. Execution of hivelist command
The results after running hivelist command showed in
Figure 7. We could locate the virtual addresses and physical
addresses in memory corresponding to the registry files on
hard drive. If we need to do further analysis of a registry key,
we must execute this command previously in order to locate
the virtual addresses of the registry key.
In general, forensic investigators can retrieve data from
registry related to information about hardware and software
configuration, users preference, information about systems
initialization configuration, user login and password
information.
IV. CONCLUSION
Forensics analysis of physical memory is relatively a new
field of research. The study started late. Although some
progress has been obtained, there are still many problems.
Firstly, it is a lack of reliable and practical hardware
device to access physical memory. Hardware based method
to get the systems physical memory is an ideal solution as it
almost doesnt affect systems physical memory. We could
obtain a very complete physical memory without irruption by
using hardware method. But the present hardware device
such as Tribble, FireWire and so on still need further
improvement
Secondly, although there are a lot of software tools for
acquisition of systems physical memory, software tools will
inevitably damage or even override the contents of physical
memory. How to improve software tools to make minimize
impact on physical memory is our next issue to research.
223


Thirdly, it is a lack of relatively mature tools for analysis
of physical memory. More powerful analysis tools need to be
researched and developed.
ACKNOWLEDGMENT
This work was financially supported by the basic science
project of Ministry of public security, project number:
2012GABJ C035 and National Development and Reform
commission, project number: [2012]1424.
REFERENCES
[1] H. Carvey. Windows Forensics Analysis. Syngress,2007.
[2] N. Ruff. Windows memory forensics. Journal in Computer Virology,
November 2007.
[3] J oanna Rutkowska. Beyond The CPU: Defeating Hardware Based
RAM Acquisition Tools (Part I: AMD case. Black Hat J apan,
February 2007.
[4] J . D. Kornblum. Exploiting the rootkit paradox with windows
memory analysis. Technical report.
[5] G. Palmer. A road map for digital forensic research. Technical report,
Report from the Digital orensic Research Workshop (DFRWS),
November 2001.
[6] MoonSols DumpIt goes Main stream. http://www.moonsols.com
[7] The Volatility Framework. http://code.google.com/p/volatility/
[8] http://code.google.com/p/volatility/wiki/FAQ
[9] Stefan Vomel,Felix Freiling. A survey of main memory acquisition
and analysis techniques for the windows operating system.Digital
Investigation 8 (2011)3-22
[10] Nicole Lang Beebe, J an Guynes Clark. Digital forensic text string
searching. Digital forensic esearch workgroup,2007.
[11] Pter Szr. Memory scanning under windows NT.Virus Bulletin
Conference, September 1999.
[12] Lodovico Marziale Golden G. Richard III Vassil Roussev Andrew
Case, Andrew Cristina. Face: Automated digital evidence discovery
and correlation. In proceedibgs of the annual DFRWS conference, 5,
2008.
[13] Ali Reza Arasteh and Mourad Debbabi. Forensic memory analysis:
Fromstack and code toexecution history. In proceedings of the annual
DFRWS, 2007.
[14] Mariusz Burdach. Digital forensics of the physical memory. March
2005.
[15] Carrier. J oe Grand carrier. A hardware-based memory acquisition
procedure for digital investigations. 2004.

224