Capturing RAM

Lecture Overview:

• Where can you find information on a running computer, capturing ram and virtual memory and extracting information from it:
• Capture memory with FTK Imager - (1:40)
• Strings command - (6:23, 10:30)
• PhotoRec - (7:41, 12:02)

• NOTE: It is important that you follow along, that is, duplicate, what I'm while watching the video.  When I demonstrate a command, you should have your Linux running, and do what I do.  You can pause the video and restart it when you are ready to progress

Download Video:

• (Right click this link and use "Save As...") Capturing RAM

 Downloads:

• Download FTK Imager 3.2.0:
• AccessData Product Downloads
• Follow These Directions
• Run FTK Imager from a flash drive (Imager Lite) : Support Portal
• Original FTK Imager Lite 3.1.1
• FTK Imager Lite 3.1.1
• Original version of Lite which extracts directly to a USB

Additional Supporting Material:

• Finding Digital Evidence in Physical Memory - Mariusz Burdach
• Sysinternals' Strings
• CGSecurity's PhotoRec
• Cyberarms, Memory Forensics
• SANS DFIR, Getting Started with Linux Memory Forensics