For years the golden rule of digital forensics was to "pull the plug" and acquire the drive. Today that rule needs rethinking. The RAM of a running system contains information found nowhere else, which vanishes the moment the computer is switched off. Memory analysis, or memory forensics, has become an essential part of investigations, especially in cyber attacks.
What memory contains
RAM is the workspace of the operating system and programs. At any moment it holds:
- running processes, with their parent-child tree, meaning which program started which;
- active network connections, with addresses and ports;
- files and registry keys opened by each process;
- libraries loaded by programs;
- commands typed in terminal windows;
- fragments of documents, messages and web pages in use;
- encryption keys for volumes and applications, in some cases;
- malicious code that lives only in memory and writes nothing to disk.
That last point is decisive. A growing share of attacks uses so-called "fileless" techniques, which run code directly in memory or abuse legitimate system tools. They may leave very few traces on disk; in memory, as long as the system is running, they are visible.
When acquiring memory makes sense
- ongoing security incidents, to identify the malicious program and its connections;
- unlocked encrypted drives, when switching off would make the data inaccessible;
- suspected use of encrypted communication tools, whose content may be present in clear text in memory;
- systems that cannot be switched off, such as production servers.
If the system is already off, the memory is lost and there is no point trying to recover it. Some residual information may be found in the paging file or the hibernation file, which are partial copies of memory written to disk.
How it is acquired
Memory acquisition is necessarily a "live" operation: it happens on a running system and requires running a program on the computer itself. This introduces an unavoidable change, because the tool itself occupies some memory. The goal is to keep that impact to a minimum and document it.
Good practice:
- use a reliable, well-tested tool, run from external media rather than installed on the system;
- save the output to external media, never to the drive of the system under examination;
- record start and end times, tool version and size of the resulting file;
- calculate the hash of the acquired memory file;
- acquire memory first and the drive afterwards, following the order of volatility: data that disappears fastest is collected first.
Unlike a drive, memory changes continuously while it is being copied. Two successive acquisitions will never be identical, and there is no original to compare the hash with. Here the hash serves to guarantee that the acquired file does not change from that moment on.
How it is analysed
The memory file is a raw sequence of data. Interpreting it requires tools that know the operating system's internal structures and can rebuild processes, connections and objects. One of the best known in the open-source world is Volatility, which offers modules for listing processes, finding injected code, extracting commands and much more.
A typical analysis proceeds like this:
- list the processes and look for those with unusual names, odd paths or unexpected parents;
- examine network connections, looking for links to unknown addresses;
- check memory areas with unusual execute permissions, a sign of possible injected code;
- extract commands and interesting strings;
- compare the results with data from the drive and network logs.
An example
A server shows traffic to an unknown foreign address, but the antivirus detects nothing. Memory analysis reveals a legitimate system process that launched a hidden command window, which runs a script directly in memory. There is no malicious file on disk, but memory holds the script, the command-and-control address and the credentials used. Without the RAM acquisition, the incident would have remained largely unexplained.
Limits
Memory analysis requires specific skills, and results depend on the exact operating system version. Some malicious programs try to hide in memory too. Moreover, memory is a snapshot of an instant: what happened earlier and is no longer active may not appear. It must therefore always be combined with analysis of the drive, logs and network.
In short
- RAM holds processes, connections, commands and sometimes keys that vanish at shutdown.
- Many modern attacks are visible mainly in memory.
- Acquisition is live, run from external media and must be carefully documented.
- Follow the order of volatility: memory first, then the drive.
- Memory analysis should always be combined with drive, log and network analysis.