How to analyze RAM through Kali Linux Forensics mode
crwdns2944109:0crwdnd2944109:0Jacob Mehnertcrwdnd2944109:0crwdnd2944109:0crwdnd2944109:0crwdne2944109:0
crwdns2944111:0July 11, 2022crwdne2944111:0
crwdns2915892:0crwdne2915892:0
crwdns2942287:0crwdne2942287:0Much like how a memory analysis can be done on a hard drive, memory analysis can also be done on RAM modules. Because RAM is a volatile memory source, which means as soon as it is turned off it will loose data.
However, one of the cool things that can be done with memory analysis is that a user can recreate what was happening when an issue occurred by using the Volatility application.
crwdns2942213:0crwdne2942213:0
crwdns2943213:0crwdne2943213:0
crwdns2943215:0crwdne2943215:0
crwdns2944105:0crwdne2944105:0
-
-
Plug in your Live Kali Linux USB into your computer and restart your PC.
-
Once your machine is finished restarting you should see Kali's Boot Loader.
-
-
-
Choose Live (forensic mode) from the list of options.
-
-
-
Press Ctrl + Alt + T to open the Terminal Interface.
-
-
-
Navigate to the Volatility directory with the command: cd /usr/share/volatility
-
-
-
Search for the RAM's profile with: python vol.py imageinfo -f=<location of image file>
-
Because Volatility is a Python script, you can enter the command python vol.py -h to gain additional information.
The most important thing you should take away from this guide is to remember to use this information responsibly. Obtaining unauthorized access to another's computer system or systems is illegal under the Computer Fraud & Abuse Act.
Please use the knowledge gained from this guide responsibly.
Because Volatility is a Python script, you can enter the command python vol.py -h to gain additional information.
The most important thing you should take away from this guide is to remember to use this information responsibly. Obtaining unauthorized access to another's computer system or systems is illegal under the Computer Fraud & Abuse Act.
Please use the knowledge gained from this guide responsibly.
crwdns2935221:0crwdne2935221:0
crwdns2935227:0crwdne2935227:0
