Svetlana Ostrovskaya, Oleg Skulkin, "Practical Memory Forensics: Jumpstart effective forensic analysis of volatile memory", Packt Publishing, 2022

Introduction

In this post, I will be providing a comprehensive review of a fascinating book on memory forensics. Memory forensics, also known as volatile memory analysis, is a cutting-edge field within digital investigations that focuses on extracting valuable information from a computer's volatile memory.

The book I will be reviewing covers a wide range of topics related to memory forensics, providing both theoretical knowledge and practical techniques for conducting memory-based investigations. It is an invaluable resource for professionals in the field, including digital forensics experts, incident responders, malware analysts, and cybersecurity enthusiasts looking to enhance their skills.

Summary of the Book

In the following sections, I will provide an overview of the book's contents, highlighting each chapter's key concepts and areas of focus. By the end of this review, you will have a clear understanding of the book's scope and the valuable knowledge it imparts.

• Chapter 1: Why Memory Forensics?
  This chapter introduces the concept of memory forensics and its importance in digital investigations. It highlights the advantages of memory forensics over traditional disk-based forensics and discusses the role of memory forensics in incident response, malware analysis, and other security-related scenarios.

• Chapter 2: Acquisition Process
  The acquisition process chapter details the various methods and techniques used to collect memory images from a target system. It discusses both software and hardware-based acquisition tools and highlights best practices to ensure the integrity of the collected memory image.

• Chapter 3: Windows Memory Acquisition
  This chapter focuses specifically on Windows-based systems, exploring the unique challenges and opportunities associated with acquiring memory from these machines. It examines available tools and methodologies for Windows memory acquisition and guides on selecting the most appropriate tool for a given situation.

• Chapter 4: Reconstructing User Activity with Windows Memory Forensics
  In this chapter, the reader learns how to reconstruct user activity using Windows memory forensics. The chapter delves into various techniques for recovering artifacts such as browsing history, opened documents, and executed commands from memory, enabling the investigator to piece together a comprehensive timeline of user activity.

• Chapter 5: Malware Detection and Analysis with Windows Memory Forensics
  This chapter covers how to detect and analyze malware using memory forensics on Windows systems. It explains the indicators of compromise (IOCs) and various techniques to identify and examine malicious artifacts in memory, helping investigators to better understand the behavior and purpose of the malware.

• Chapter 6: Alternative Sources of Volatile Memory
  The sixth chapter discusses other sources of volatile memory beyond RAM, including CPU caches, video memory, and specialized hardware memory. It explains how these alternative memory sources can provide valuable information for forensic investigations and offers techniques for acquiring and analyzing them.

• Chapter 7: Linux Memory Acquisition
  This chapter explores memory acquisition on Linux systems, addressing the unique challenges and tools available for these environments. It provides an overview of Linux memory forensics tools and discusses best practices for acquiring memory images from Linux-based systems.

• Chapter 8: User Activity Reconstruction
  In this chapter, the focus shifts to reconstructing user activity on Linux systems using memory forensics. It details techniques for recovering user activity artifacts, including browsing history, opened documents, and executed commands, enabling investigators to build a comprehensive timeline of events.

• Chapter 9: Malicious Activity Detection
  This chapter covers the detection of malicious activity on Linux and systems using memory forensics. It discusses the indicators of compromise (IOCs) and various techniques to identify and examine malicious artifacts in memory, providing insights into the behavior and objectives of the threat actors involved.

• Chapter 10: MacOS Memory Acquisition
  This chapter delves into memory acquisition on macOS systems, exploring the unique challenges and tools available for these environments. It offers an overview of macOS memory forensics tools and discusses best practices for acquiring memory images from macOS-based systems.

• Chapter 11: Malware Detection and Analysis with macOS Memory Forensics
  The final chapter covers how to detect and analyze malware using memory forensics on macOS systems. It explains the indicators of compromise (IOCs) and various techniques to identify and examine malicious artifacts in memory, helping investigators to better understand the behavior and purpose of the malware on macOS systems.

My Review Comments

This book offers a practical and example-driven exploration of memory forensics. The initial chapters lay a solid foundation by discussing the theoretical underpinnings and necessary preparatory procedures for memory forensics. Subsequently, chapters 3 to 6 provide in-depth coverage of Windows forensics, chapters 7 to 9 delve into Linux forensics, and the final two chapters (10 and 11) focus on macOS memory forensics. Notably, this book stands out by encompassing a wider range of platforms, as many memory forensic resources tend to concentrate solely on Windows.

Moreover, the book incorporates exercises that leverage volatility2, an open-source memory forensic tool. It is important to note that at the time of publication in 2022, volatility was undergoing a transition to volatility3, which is built on Python 3. Consequently, it is somewhat regrettable that the book solely addresses volatility2.

The inclusion of hands-on exercises that involve solving Capture The Flag (CTF) challenges adds significant value by facilitating practical learning. However, one aspect that could have been further enhanced is the explanation of how to develop custom plugins to fulfill specific requirements.