digital forensics of ram images using volix ii - … · © fh aachen university of applied sciences...
TRANSCRIPT
![Page 1: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/1.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 1
Digital Forensics of RAM Images Using VOLIX II
Patrick Bock
FH Aachen, University of Applied Sciences
![Page 2: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/2.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2
Contents
Introduction
Problems and Solutions
Case example
![Page 3: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/3.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 3
Contents
Introduction
Problems and Solutions
Case example
![Page 4: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/4.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 4
Introduction
Volatility Framework
Open source
Is under constant development
Many different commands
Command line program
Requires good knowledge of the commands
![Page 5: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/5.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 5
Introduction
Investigation with the Volatility Framework
Type in every command
Set all parameters manually
Extract information for parameters from results
No documentation of the procedure
![Page 6: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/6.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 6
Introduction
![Page 7: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/7.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 7
Introduction
Volix II (Volatility Interface & Extensions)
Interface for the Volatility Framework
Embed other programs
Investigation with Volix II (Version 1)
Add commands easily
Set all parameters manually
Extract information for parameters from results
Simple documentation
![Page 8: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/8.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 8
Introduction
![Page 9: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/9.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 9
Introduction
![Page 10: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/10.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 10
Introduction
![Page 11: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/11.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 11
Contents
Introduction
Problems and Solutions
Case example
![Page 12: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/12.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 12
Problems and Solutions
Problem
Volatility Framework 2.2 integrated
Current version 2.3.1 has much more commands
Solution
Support version 2.3.1
Implement all commands
![Page 13: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/13.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 13
Problems and Solutions
Problem
Extensive investigation
Start each command
Inspect all results precisely
Parameterize each command
Takes a long time
![Page 14: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/14.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 14
Problems and Solutions
Solution
Automate investigation
Let commands run parallel
Start up to three ready commands
When a command is finished examine its result
Set parameters for commands
Repeat until no command can be started
![Page 15: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/15.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 15
Problems and Solutions
Problem
User has to know the commands
Dependencies among commands
Solution
Assistance in the form of Wizards
Questionnaire for the user
![Page 16: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/16.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 16
Problems and Solutions
Problem
Simple final report
Plain text file with all the information
Solution
Information in XML-File
Representation by XSL file
![Page 17: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/17.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 17
Problems and Solutions
Further improvements
Better helpfile for the program
Case example in the helpfile
Individual dialog view for „hashdump“
Extract SAM hashes
Crack hashes with John the Ripper
![Page 18: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/18.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 18
Contents
Introduction
Problems and Solutions
Case example
![Page 19: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/19.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 19
Case example
Preparation
Create folder structure
Provide RAM image
Investigation_BlackEnergy
ResultDumps
Miscellanous
![Page 20: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/20.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 20
Case example
![Page 21: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/21.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 21
Case example
![Page 22: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/22.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 22
Case example
![Page 23: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/23.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 23
Case example
![Page 24: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/24.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 24
Case example
![Page 25: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/25.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 25
Case example
![Page 26: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/26.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 26
Case example
![Page 27: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/27.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 27
Case example
![Page 28: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/28.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 28
Case example
![Page 29: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/29.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 29
Conclusion
Thank you for your attention
VOLIX II is available under
http://www.it-forensik.fh-aachen.de/projekte/volixe
![Page 30: Digital Forensics of RAM Images Using VOLIX II - … · © FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 2 Contents Introduction](https://reader030.vdocuments.us/reader030/viewer/2022021804/5b9fec7f09d3f267388c0502/html5/thumbnails/30.jpg)
© FH AACHEN UNIVERSITY OF APPLIED SCIENCES Digital Forensics of RAM Images Using VOLIX II - Patrick Bock | 30
Workshop
RAM-Image:
http://code.google.com/p/volatility/wiki/SampleMemoryImages
VirusTotal:
https://www.virustotal.com/de/