LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 11-26-2020, 05:10 PM   #1
walterbyrd
Member
 
Registered: Apr 2004
Posts: 734

Rep: Reputation: 46
Best way to capture volatile memory


Of these four ways, what is the best way to capture volatile memory comprehensively from a running machine for forensic purposes?

1. FTK Imager
2. memdump -k
3. dd if=/dev/mem . . .
4. LiME, or other kernel module capture utility?
 
Old 11-27-2020, 09:26 AM   #2
iTick
LQ Newbie
 
Registered: Nov 2020
Location: Denmark
Distribution: Debian
Posts: 11

Rep: Reputation: 12
I don't do much in terms of forensics but FTK is used by professionals. And is free.
Some times the hard work, if it would be used in court, would be to prove the evidence is valid and nothing was altered by the analyst or the tool.
And of course if the tool represents the truth.

I am not sure if it would be done using a firewire port or so, today, so you don't have to execute it on the box itself, as it would inherently change the memory you are trying to dump.
If you can find a tool listing for the SANS 500 or 508 class you would be on the right path.

I dont know LiME unfortunately.

https://www.sans.org/cyber-security-...ting-training/
https://www.sans.org/cyber-security-...nsic-analysis/
I am not sure if the links are useful but have a look.

Last edited by iTick; 11-27-2020 at 09:30 AM. Reason: Added links.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[C++] Volatile object is often only used to synchronize access to non-volatile data. Aquarius_Girl Programming 1 05-28-2012 08:36 AM
Samba with volatile profiles? adm1329 Linux - Server 2 06-14-2007 12:06 PM
NVM Non-volatile Memory access compent (API) yantai Linux - General 3 05-11-2007 01:17 PM
volatile kalleanka Programming 2 08-17-2006 08:38 AM
about "volatile" vijeesh_ep Programming 3 08-23-2004 11:30 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 08:42 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration