Chapter 29
Examining Volatile Data
This chapter includes the following topics
Using the Volatile Tab (page 389)
Understanding Memory (page 391)
Viewing Memory Dump Data (page 392)
Performing File Remediation from the Volatile Tab (page 394)
Killing a Process (page 394)
Wiping a File (page 395)
Adding Hashes to KFF Library from the Volatile Tab (page 395)
Adding Hashes to Fuzzy Hash Library from the Volatile Tab (page 396)
Creating a Memory Dump File (page 396)
Examining Volatile Data | 388
Using the Volatile Tab
The Volatile tab provides tools for viewing, finding, and comparing data gathered from the memory of live agent systems in your network. Other data acquired remotely, such as from a Mounted Image Drive or a Mounted
Device is viewable from other tabs. The Volatile tab is specifically for remote memory data acquired as a memory dump. It can be added directly to a case upon acquisition, or saved as a dump file to be added to any case at a later time.
See Working with Live Evidence (page 142).
When you have acquired volatile (Memory) data as a dump file the resulting acquisition data is displayed in the
Volatile tab.
There are three main areas in the Volatile tab:
1.
2.
Tabbed Data View
Detail List View
3.
Detailed Information View
It is important to remember that the views relate clockwise. When an item is selected in the Tabbed Data view, the related information is displayed in the Detail List view. An item selected in the Detail List view will display relevant information in the Detailed Information view, within the data tab that relates to the type of item that is selected.
The Tabbed Data view has three tabs:
Snapshot
Find
Difference
Examining Volatile Data Using the Volatile Tab | 389
Each Tabbed Data View displays a summary of acquired volatile data.
Data View Sort Options
Button Description
Sort acquired volatile data by Operation Type, such as those selectable from the Evidence > Add
Remote Evidence > Selection Information dialog box. Found on Snapshot, Find, and Difference tabs.
Sort acquired volatile data by the Time of Acquisition, displayed in the local machine’s time. Found on
Snapshot
,
Find
, and
Difference
tabs.
Sort acquired volatile data by the Source Machine or Agent. Found on
Snapshot
,
Find
, and
Difference
tabs.
Display saved comparisons. When a comparison of found data is done, the results can be saved and viewed later. Found only on the
Difference
tab
Geolocation. This button on the Volatile tab that will launch Geolocation for volatile data.
See Viewing Geolocation IP Locations Data on page 451.
The Detail List View provides information specific to the item currently selected in the Data View. The content of the Detail List changes as different items are selected.
The Detailed Information View shows more specific information about the item in the Data View, and its selected component in the Detail List view.
Examining Volatile Data Using the Volatile Tab | 390
Understanding Memory
Memory can include the physical “sticks” of memory that we put into the machine, commonly referred to as physical memory. However, video cards, network cards, and various other devices use memory that the
Operating System (OS) must be able to access in order for the devices to work properly. Both physical memory and device memory are organized by the OS in a linear address map. For 32-bit operating systems, the linear address map is naturally 4GB. Traditionally the OS will put physical memory at the bottom of this map and the device memory at the top.
When a system has a full 4GB of physical memory, using all 4GB wouldn’t leave any room to address the device memory.
Since the OS can’t function without access to the device memory, it simply doesn’t use all 4GB of physical memory. Evidence of this fact can be seen on the main Properties window of My Computer. If you have a 32-bit
Windows XP system with 4GB of physical memory, you may notice that the Properties window will show that you have only 3.25GB of physical RAM. That limitation allows for addressing of devices within the 4GB address space.
Most acquisition products check how much physical memory is available (4GB using our example above), open a handle to the OS’s memory map (referred to as \Device\PhysicalMemory) and start reading, one page at a time. Thus, in an attempt to read all of the physical memory, what they are actually reading is the OS’s linear address map of both physical and device memory. However, some device memory is not meant to be read and the simple act of reading it could cause system instability. In fact, if the OS is 64-bit, this algorithm would miss the physical memory that was placed beyond the 4GB range.
The approach AccessData takes is to query the OS’s memory map for the regions that correspond to physical memory and only acquire those regions - filling the other regions with zeros. This method not only avoids any issue with system instability but also guarantees that it acquires all the physical memory that the OS is able to use — the memory that anyone would normally be interested in.
Examining Volatile Data Understanding Memory | 391
Viewing Memory Dump Data
A Memory Dump file includes all the Processes, DLL s, Sockets, Drivers, Open Handles, Processors, System
Descriptor Tables and Devices in use at the time of the acquisition. The Volatile tab provides a view of all this data by type.
Right-click on any dump file in the Snapshot view to choose View Memory or Search Memory.
Viewing Hidden Processes
Hidden processes are automatically detected. There is no way to disable or turn off this feature. The detection compares a list of processes in memory to the operating systems’s processes list to determine whether any running processes do not belong. These are the processes that are highlighted in yellow.
Hidden processes, when detected in a Memory Dump file, and found only in the Process List. Click on a dump file in the Process List, then scroll down the Detail List to locate any lines highlighted in yellow.
Click on a yellow-highlighted line in the Detail List to display related information in the Detailed Information list.
Scroll across the columns list to see all the data.
Viewing Input/Output Request Packet Data
Input/Output Request Packet (IRP) data, also known as memory hooks, when detected in a memory dump file, are indicated in the Snapshot view by a yellow warning indicator. Memory hooks can be used for both legitimate and non-legitimate purposes.
In the Detail list, the items that contain memory hooks are highlighted in pink. Click on a pink-highlighted item to open that item in the Detailed Information view. The IRP tab shows the items and properties that are related to the IRP data that was detected. This data does not identify whether the IRP was bad or good, only that it was there, so you can determine its nature.
Tabs in the Detailed Information list provide additional related data for the selected data type. Some data types have several tabbed pages, and some have only a few. Each tabbed page contains different information related to the selected item, and each displays properties specific to the tabbed page for that information type. The property column headings are sortable to make it easier to locate critical information.
In addition to the IRP data view, access is provided to Service Descriptor Tables (SDT), and System Service
Descriptor Tables (SSDT).
Up to four SSDT tables are available. The four tabs are placeholders only; their existence does not indicate nor guarantee they will be populated. Notice that the names of the populated tables’ tabs are longer than those that are not populated. Only the data that is found in the evidence can be displayed.
Viewing Virtual Address Descriptor (VAD) Data
In the Windows operating system, every object opened by a program (example files, screens, sections of memory, etc.) is assigned a handle that the process in which the program is running can use. These handles are stored in a table that is managed by the process. This table is called the virtual address descriptor table (VAD).
Examining Volatile Data Viewing Memory Dump Data | 392
A single process normally contains many VADs. Each VAD describes a range of virtual pages and tells the
Memory Manager what those virtual pages represent. For example, a typical process will consist of an executable image (the program) and a set of dynamic link libraries (DLLs) that are used within that process, as well as data that is unique to the program. Each of these separate items exists somewhere within the address space of the program.
When each component is first loaded into the address space, the Memory Manager creates a new VAD entry for each such range of addresses. These VAD entries are in turn linked together in a binary tree that optimizes access to the most recently accessed VAD. This representation makes it is easy to describe a sparse address space using a tree of VADs, it is fast to find entries within the VAD tree, and it is easy to reorganize VAD entries as necessary.
Investigating the VAD tree lets you view resources allocated by a program. The VAD tree constantly changes during execution of a program. Each time the VAD tree is read, the results are different.
5.
6.
7.
1.
2.
3.
4.
To view Virtual Address Descriptor (VAD) Data
In the Examiner, select the Volatile tab.
In the Snapshot tab, expand Process List.
Expand the date of the snapshot.
Select the computer name.
In the upper-right pane, under Detail List, select a process.
In the lower-right pane, under Detailed Information, click the VAD tab.
The Virtual Address Descriptor (VAD) information is displayed in the Detailed Information pane.
Examining Volatile Data Viewing Memory Dump Data | 393
Performing File Remediation from the Volatile Tab
Certain file remediation tasks are available for specific data types in the Volatile tab. After a remote volatile data acquisition is completed, click to expand the data type in the Snapshot tabbed view, then right-click on the item in the Detail List to choose from the available file remediation options.
Volatile Tab File Remediation Options
Volatile Data Type
Process List
DLL List
Sockets
Driver List
Open Handles
Processors --
System Descriptor Table --
Devices --
--
--
--
--
Kill Process
X
--
--
Wipe File
X
--
--
--
--
--
--
--
--
--
X
--
X
X
Add
Hashes to
KFF Lib
--
--
--
--
X
--
X
X
Add
Hashes to
Fuzzy Lib
--
--
--
--
Dump
X
X
--
Killing a Process
Kill Process ends a process running on the remote computer the data was acquired from.
To kill a process
1.
2.
3.
4.
5.
In the Snapshot view, click and expand the Process List.
In the Detail List, highlight or mark the check boxes of the processes to be killed.
Right-click in the Detail List and select Kill Process.
In the Select Source dialog box, select either Highlighted Detail List items, or Checked items.
Click OK.
Examining Volatile Data Performing File Remediation from the Volatile Tab | 394
Wiping a File
Wipe File completely removes a file from the remote computer the file was acquired from.
To wipe a file
1.
2.
3.
4.
5.
In the Snapshot view, click and expand the Process List.
In the Detail List, highlight or mark the check boxes of the file to be wiped.
Right-click in the Detail List and select Wipe File.
In the
Select Source
dialog box, select either Highlighted Detail List items, or Checked items.
Click OK.
Adding Hashes to KFF Library from the Volatile Tab
Hashes can be added directly to the KFF Library directly from the Volatile tab.
To add hashes to the KFF Library
5.
6.
7.
1.
2.
3.
4.
In the Detail List, highlight or mark the check boxes of the hashes to add to the KFF Library.
Right-click in the Detail List, and click Add Hashes to KFF.
Provide a name for the set.
Click Add all hashes to add the hashes of all displayed items, or Add only checked hashes in the current Detail List.
Select either Alert or Ignore.
Choose whether or not to Activate in [the current] case.
Click OK.
Examining Volatile Data Wiping a File | 395
Adding Hashes to Fuzzy Hash Library from the Volatile Tab
Hashes can be added directly to the Fuzzy Hash Library directly from the Volatile tab.
To add hashes to the Fuzzy Hash Library
1.
5.
6.
7.
8.
2.
3.
4.
In the Detail List, highlight or mark the check boxes of the file(s) hashes to add to the Fuzzy Hash
Library.
Right-click in the Detail List, and click Add Hashes to Fuzzy.
Provide a name for the set.
Click Add all hashes to add the hashes of all displayed items, or Add only checked hashes in the current Detail List.
Select either Alert or Ignore.
Assign a Threshold Value.
Choose whether or not to Activate in [the current] case.
Click OK.
Creating a Memory Dump File
A dump file can be created and added to the case directly from the Volatile tab.
To create a Dump file
1.
2.
3.
4.
5.
6.
In the Snapshot view, click and expand the Process List or the DLL List.
In the Detail List, highlight or mark the check boxes of the files to be dumped.
Right-click in the Detail List and select Dump to file.
In the Dump a file dialog box, mark Include DLLs with processes, and/or Include parent process
with DLLs.
Browse to and select a destination path for the dump file.
Click OK.
Examining Volatile Data Adding Hashes to Fuzzy Hash Library from the Volatile Tab | 396
