ISSN (Print) : 0974-6846

Indian Journal of Science and Technology, Vol 9(48), DOI: 10.17485/ijst/2016/v9i48/105851, December 2016 ISSN (Online) : 0974-5645

Memory Forensics: Tools and Techniques

Shreshtha Gaur* and Rita Chhikara
Department of CSE/IT, TheNorthCap University, Gurugram, Haryana - 122017, India;
[email protected], [email protected]

Abstract
Objectives: To evaluate the performance of different tools that acquire, analyze and recover the evidences of crime from
volatile memory. A comparison between different tools is presented with the aim of generating better understanding of
the tools employed. Methods: Volatile memory stays for a very short period and that is why it is always hard to analyze
such memory. It contains much useful information such as passwords, usernames, running processes, etc. Acquiring,
analyzing and recovering are the three major steps for memory forensics. Experiments are performed with different tools
to understand the procedure of acquiring, analyzing and recovering important evidences. Findings: The strengths and
drawbacks of all the tools are analyzed that providesa better understanding of the working of the tools in specific scenarios.
The tools like FtkImager and Belkasoft represent the data as a tree structure which makes it difficult to analyze the data. All
the tools investigated are not entirely fitted for a particular situation hence; the investigation needs to rely on many tools
that can retrieve useful information from the evidences. It is important to know the usefulness of a tool before it is applied
to solve a crime. Although most of the tools are successful in providing reasonable evidence, no single tool is sufficient to
complete the investigation. Improvements: Most of the tools work as passive agents that is it is left to the discretion of
the investigator to analyze the evidences collected through different tools. The tools can be improved by combining it with
machine learning techniques. This paper also discusses the improvements that can be done in order to make the working
of the tools easier and yielding better results.

Keywords: Acquisition Memory Tools, Analyzing Memory Tools, Digital Forensics, Live Analysis, Memory Forensics,
Recovering Memory Tools.

1. Introduction The shutting down of the systems could lead to loss to

companies. Another problem faced with static methods
Digital Forensics is a science of investigating and is that modern operating systems3,4 support encryption
recovering evidence from digital devices using different which makes traditional approaches unsuccessful. It
tools. With the advancement of technology, the cybercrime is easier to extract cryptographic key directly from
rate has increased drastically. To curb the effects of such the RAM when the system is live. The live analysis has
crimes digital forensics has gained popularity in recent become a need with the increase of cyber crime because
years1. Digital analysis can be broadly studied under individuals have started deleting the contents as soon as
two headings a) static or dead analysis where, the target possible without saving the contents on the hard drive.
devices that are to be analyzed are shut down and b) live Hence in order to retrieve more valuable information the
analysis where, the system stays in the boot mode and forensic analyst needs to examine the volatile memory.
is kept alive. The traditional static analysis approaches This science of examining the volatile or live memory is
work by generating bit-by-bit image of the hard disks referred to as Memory Forensics5.
after switching off the system and performing detailed The backbone of any type of digital forensic is the
investigation on the collected information2. However step by step analysis and documentation. The first step
these methods have certain drawbacks. is to identify the suspicious elements that can be the

* Author for correspondence

 Memory Forensics: Tools and Techniques

cause of harmful effects. Thereafter tools, techniques and like medical16 and big data mining17. Some of the authors
search warrants need to be identified. A very important have also worked with meta-heuristic techniques18 for
step for forensic analyst is to develop a strategy in order cloud computing which is another upcoming area. Major
to catch the criminal without damaging the evidences. challenges faced with cloud forensics19 is that it is not
The collected evidences then need to be preserved either possible to capture the evidence as a single snapshot,
physically or digitally. The next step involves recording hence information such as time and volume related to
of the evidences collected during investigation. Finally, snapshots need to be maintained in a table. Another
examining the collected evidences in order to gain in- technique employed by authors is time analysis20 on
depth knowledge of the crime6. Windows operating system to investigate forensic crime.
Memory forensics is an emerging science of forensics However memory forensics is still in its infancy and
and there are many tools that can be helpful in order to machine learning or optimization techniques have yet to
retrieve the suspicious activity. Memory forensics or be explored for this dynamic area.
Live memory acquisition has not got much attention in In this paper we provide different tools for acquiring,
the previous years because of the typical nature of this analyzing and recovering the evidence from volatile
memory that is its volatile nature. It not only provides memory. This paper also discusses the strengths and
sufficient information of running processes, applications, weaknesses of each tool and provides suggestion for
passwords, login credentials, hidden data etc. but also improving the tools.
about terminated and cache processes7. Live Memory
Analysis can bevery useful in analyzing the traces left by
Malware. In order to perform live memory acquisition,
2. Tools and Techniques
the first step is to capture the live memory (ie memory Memory Forensics can be studied broadly under three cat-
dump). Memory dump stores the contents the user has egories:
used and can be useful in order to examine the cause of
• Acquisition of memory
system crash. However in memory forensic the acquisition
• Analyzing the acquired data
and analysis takes place at the same time raising questions
• Recovering the evidence.
on the authenticity of the data8.
The data in volatile memory is always in flux and
it is very hard to guess that for how long the data will 2.1 Acquisition of Memory
persist in the memory. Intuitively, it is assumed that the Collecting the “memory image” from the live memory
metadata about processes and other objects can survive is not an easy task. As the name suggests the data we
in physical memory for more than 14 days while the are acquiring is from the live memory so we need to
system is in use. But no confirmation can be given in this be very careful as little de-allocation can trigger heap
regard9. Researchers have applied different techniques for defragmentation. There are various tools & techniques for
memory forensics such as acquiring memory image10 and Windows used to acquire the volatile memory in order to
extracting memory page file11. In another work, researcher extract malicious programs in it. The tools are easy to use
has explored counter measure tools and classified root and can yield interesting results.
kits in three levels which are application, library and
kernels12. In another method author has given ways of 2.1.1 Belkasoft Live RAM Capturer
collecting files associated with virtual machine13. Authors Belkasoft Live RAM Capturer21 is a free volatile memory
have successfully worked with crime data using machine forensic tool to capture the live RAM as depicted in Figure
learning algorithms14. Another area in digital forensics 1. It is equipped with 32-bit and 64-bit kernel drivers
has been explored by researchers with machine learning allowing the tool to operate in the most privileged kernel
techniques to search for patterns which indicate hidden mode. The memory dump will be stored with .mem
secret messages in multimedia carriers15. The machine extension and later it the memory dump can be analyzed
learning techniques like classification and clustering have using Belkasoft evidence centre tool.
also been successfully applied in other upcoming areas

2 Vol 9 (48) | December 2016 | www.indjst.org Indian Journal of Science and Technology
 Shreshtha Gaur and Rita Chhikara

Figure 1. Acquiring memory image using Belkasoft Live RAM Capturer.

Figure 2. “Capture memory” option is selected to acquire memory image.

2.1.2 Ftk Imager captured memory dump. It stores the memory dump with
memextentionas depicted in Figure 3 which later can be
The Ftk Imager22 creates a bit-by-bit image, including
analyzed using wxHexEditor tool or some another tool.
unallocated space and slack space. It helps to capture the
live RAM as shown in Figure 2 but cannot analyze the

Figure 3. Acquiring memory image process with FtkImager.

Vol 9 (48) | December 2016 | www.indjst.org Indian Journal of Science and Technology 3
 Memory Forensics: Tools and Techniques

a) 2.1.3 Madiant Memoryze no) is prompted as shown in Figure 5 and .mem file of
that person’s live RAM gets stored in the pen drive.
MadiantMemoryz23 is free memory forensic software that
helps incident responders find evil in live memory. It can
acquire as well as analyse the captured memory. This tool 2.2 Advantages and Disadvantages of
can acquire all running processes, all drivers, and full range Acquisition Tools
of system memory image as demonstrated in Figure 4. The various advantages of tools applied for acquiring the
important information are given in Table 1. This provides
b) 2.1.4 DumpIt a better insight in all the tools discussed.
It is a very interesting tool for those who want to capture
the RAM of some suspicious or under observation person. 2.3 Analysis of Acquired Memory Dump
This tool can be stored on a pen drive and takes less than After the acquisition of the memory image, now the
a minute to acquire the live RAM. When the pen drive memory image will be analyzed. In this phase the
is attached and DumpIt24 is executed on that person’s evidences need to be analyzed very carefully.
computer, only a confirmation question (ie. Asking yes or

Figure 4. Acquiring memory image using MadiantMemoryze.

Figure 5. Acquiring memory image using DumpIt.

4 Vol 9 (48) | December 2016 | www.indjst.org Indian Journal of Science and Technology
 Shreshtha Gaur and Rita Chhikara

Table 1. Advantages and disadvantages of the tools

Sr. No Tools Advantages • Disadvantages
1 Belkasoft Live RAM • Easy to use • After capturing memory
Capturer image, another belkasoft
• Acquire all the hidden data program need to be down-
loaded
• Does not de-allocate data from
memory
2 FtkImager • Easy to use • No progress bar

• Creates a case log file • No multi-tasking

• Fast searching & EFS decryption • De-allocates data from

memory
3 Madiant Memoryze • Can acquire running processes, • Does not work even after
drivers etc installation

• Can crack passwords if used with • Difficult to use

dumpIt
4 DumpIt • Can be used even by non-technical • De-allocates data sometimes
people

• Easy to use & acquire the memory

image quickly

2.3.1 Belkasoft Evidence Centre 2.3.2 wxHexEditor

Belkasoft21 is one of the most interesting tools till date. The memory dump captured in the FtkImager can be
The .mem file created by the Belkasoft LIVE Ram capturer analysed using wxHexEditor25. It is a free tool that can
is opened in this tool and then it can easily analyze the analyse the memory dump. It has two parts that is on the
memory dump. It is easy to understand and use and do right side the string values of information is displayed
not require any specific knowledge to run it. In Figure and on the left side the hex values of strings are displayed
6 clearly depicts the method of loading the captured which can be analyzed. In Figure 9 displays the loading
memory image file from Belkasoft live RAM capturer. of the captured memory image from FtkImager to be
Loading the data sources needed to carve is shown in analysed by wxHexEditor.
Figure 7. Finally the carved data of the captured memory
image is analyzed as depicted in Figure 8.

Figure 6. Loading of the captured memory image file from Belkasoft live
RAM capturer.

Vol 9 (48) | December 2016 | www.indjst.org Indian Journal of Science and Technology 5
 Memory Forensics: Tools and Techniques

Figure 7. Loading the data sources needed to carve.

Figure 8. Analysing the carved data of the captured memory image.

Figure 9. Loading the captured memory image from FtkImager.

6 Vol 9 (48) | December 2016 | www.indjst.org Indian Journal of Science and Technology
 Shreshtha Gaur and Rita Chhikara

The pattern can be searched by entering some words RAM. It is used to analyze the disk images and perform
in search option using this tool. In Figure 10 shows the in-depth analysis of file systems. Figure 13 shows the
results of searching the word “gmail”. working of Autopsy tool.
The result of finding the word gmail is as shown in
Figure 11. The words matching “gmail”shall be displayed 2.4 Advantages and Disadvantages of
as depicted in Fig. 11 and thereafter it can be analyzed.
Analysis Tools
The wxHexEditor can be utilized to retrieve usernames
The advantages and disadvantages of analysis tools
and passwords as shown in Figure 12.
mentioned in section 2.3 are discussed in Table 2.

2.3.3 Autopsy
2.5 Recovering Data using FtkImager
Autopsy26 is also a free tool used to analyze the captured Sometimes, the attacker deletes some sensitive information

Figure 10. Searching and Analyzing the captured memory image for
evidences.

Figure 11. Analyzing the captured memory image-gmail account.

Vol 9 (48) | December 2016 | www.indjst.org Indian Journal of Science and Technology 7
 Memory Forensics: Tools and Techniques

Figure 12. Usernames and passwords can be retrieved.

Figure 13. Analyzing the memory image and finding evidences using
Autopsy.

Table 2. Advantages and disadvantages of the tools

Sr. Analyzing Tools Advantages Disadvantages
No
1 Belkasoft Evidence Centre Can include all the data sources Do not read the dump
Easy to use & navigate
2 wxHexEditor Easy to use and understand Can be a little slow while
Can load the acquired image searching
faster Can also take some amount
of time while searching this
big data
3 Autopsy Can analyze disk images Can be a little slow
In-depth analysis of file systems

8 Vol 9 (48) | December 2016 | www.indjst.org Indian Journal of Science and Technology
 Shreshtha Gaur and Rita Chhikara

or images from the system in order to protect it. But such The attacker saved the picture and later removed it
deleted information can be recovered. Although, it is a from the file as well as from the recycle bin.
very tiring task and one needs full concentration into it The FtkImager is executed and the files in the
but the results are sometimes very interesting. unallocated space are explored to recover the deleted. The
Suppose the attacker, used the image of a puppy and file get saved with different name, hence all the files have
later deleted it from the system. Now, using FtkImager22 to be opened as FtkImager does not provide any searching
the image can be recovered as shown in the snapshots in mechanism.
Figures 14,15,16 and 17.

Figure 14. Saving the image from net in the desired destination.

Figure 15. Checking the image visibility in FtkImager.

Vol 9 (48) | December 2016 | www.indjst.org Indian Journal of Science and Technology 9
 Memory Forensics: Tools and Techniques

Figure 16. Deleting the image from the destination path and also from the recycle
bin.

Figure 17. Deleted image recovered.

3. Discussion tools freely available that assist in analyzing the volatile

memory but still there exists some gaps which need to be
Memory forensics is a vast field and the work done till bridged.
date is appreciable. In earlier times researcher’s focus was In FtkImager and Belkasofttools the data to be
on hardware acquisition but over last decade software analyzed is viewed as a tree having many branches
acquisition has marked its presence, however volatile thus, analyzing the data extracted becomes a hard task
memory forensics is still in its infancy. There are many and time consuming too. Also, it does not ensure 100%

10 Vol 9 (48) | December 2016 | www.indjst.org Indian Journal of Science and Technology
 Shreshtha Gaur and Rita Chhikara

results sometimes causing unsuccessful searches. The 4. Saout C. dm-crypt: A device-mapper crypto targe. 2016
tools studied in this paper are only designed for finding September 05. Available from http://www.saout.de/misc/
dm-crypt/.
some particular part of evidence and not in assisting the
5. Hay B, Nance K, Bishop M. Live analysis: Progress and
investigation thus, the investigation takes a good amount Challenges. IEEE Security and Privacy. 2009:7(2):30–7.
of time to solve. This basically means that investigator 6. Wang L, Zhang R, Zhang S. A model of computer live fo-
needs to apply intellect to find evidences and the tool does rensics based on physical memory analysis. Proceedings of
not provide intelligent information. 1st IEEE International Conference on Information Science
Another major challenge faced in area of forensics is and Engineering (ICISE). 2009. p. 4647–9.
7. Aljaedi A, Lindskog D, Zavarsky P, Ruhl R, Almari F.
that many tools need to be employed to get results and Comparative Analysis of Volatile Memory Forensics: Live
one tool is not sufficient during the whole process of Response vs. Memory Imaging. Proceedings of 3rd IEEE
investigation. The tools consume lot of time in retrieving International Conference on Privacy, Security, Risk and
and recovering sensitive information which could cause Trust. 2011.p. 1253–8.
undue harm and since information does not reside for 8. Petroni NL,Walters A, Fraser T, Arbaugh WA. FATKit: A
Framework for the Extraction and Analysis of Digital Fo-
long in memory important evidence could be lost.
rensic Data from Volatile System Memory. Digital Investi-
gation. 2006;3(4): 197–210.
4. Conclusion 9. Gianni F, Solinas F. Live Digital Forensics: Windows XP vs
Windows 7. Proceedings of 2nd IEEE International Confer-
ence on Informatics and Applications (ICIA). 2013. p. 1–6.
Memory forensics is an emerging field and has lot of 10. Balogh S, Pondelik M. Capturing encryption keys for dig-
scope. There are many tools existing to tackle cybercrime, ital analysis. Proceedings of 6th International Conference
however the efficiency and effectiveness of tools is not on Intelligent Data Acquisition and Advanced Computing
sufficient to handle the tremendous increase in cyber Systems (IDAACS). 2011. 2, p. 759–63.
crime. This field has a very bright future despite fast 11. Savold A, Gubian P. Towards the virtual memory space
reconstruction for windows live forensic purposes, Pro-
growth in digital forensics in last decade. The focus
ceedings of 3rd IEEE International Workshop on System-
towards memory forensics is a major step towards curbing atic Approaches to Digital Forensic Engineering. 2008. p.
cybercrime at fast pace. This paper has discussed some of 15–22.
the available tools for volatile memory. The disadvantages 12. Carrier BD. Risks of live digital forensic analysis. Commu-
and advantages of tools for performing three major nications of the ACM. 2006; 49(2): 56–61.
13. Meera V, Isaac MM, Balan C. Forensic acquisition and anal-
operations of memory forensics; acquiring, analyzing and
ysis of VMware virtual machine artifacts. Proceedings of
recovering have been discussed. IEEE Automation, Computing, Communication, Control
There is tremendous future scope in the area of and Compressed Sensing (iMac4s). 2013. p. 255–9.
memory forensics. The tree like structure generated by 14. Agarwal N, Gaur D. Classification of crime data using Rap-
some tools can be modified to reduce time and produce id Miner. International Journal of Applied Engineering Re-
better results. Also focus should be on developing a single search. 2015; 10(5): 27517–21.
15. Chhikara RR, Sharma P, Singh L. A hybrid feature selection
tool should that can successfully acquire and analyse the approach based on improved PSO and filter approaches
memory. for image steganalysis. International Journal of Machine
Learning and Cybernetics. 2015; 7(6):1195–206.
16. Shenbagarajan A, Ramalingam V, Balasubramanian C, Pal-
5. References anivel S. Tumor diagnosis in MRI brain image using ACM
Segmentation and ANN-LM classification techniques, In-
1. Reith M, Carr C, Gunsch G. An examination of Digital Fo- dian Journal of Science and Technology. 2016 Jan; 9(1):
rensics Models. International Journal of Digital Evidence. 1–12.
2002; 1(3):1–12. 17. Sajana T, Sheela Rani CM, Narayana KV. A Survey on clus-
2. Dave R, Mistry NR, Dahiya MS. Volatile Memory Based tering techniques for Big Data mining. Indian Journal of
Forensic Artifacts and Analysis. International Journal for Science and Technology. 2016 Jan; 9(3):
Research in Applied Science and Engineering Technology. 18. Hamid HM S, Shafie AL M, Yahaya C, Muhammad A S. An
2014: 2(1):120–4. appraisal of meta-heuristic resource allocation techniques
3. Microsoft Corporation. Bitlocker drive encryption. 2016 for IaaS Cloud. Indian Journal of Science and Technology.
August 30. Available from: http://technet.microsoft.com/ 2016 Jan; 9(4):1–12.
en-us/library/cc73154928WS.1029.aspx.

Vol 9 (48) | December 2016 | www.indjst.org Indian Journal of Science and Technology 11
 Memory Forensics: Tools and Techniques

19. Deevi R. R, Sk. Nazma S, Pasala L. S. Challenges of Digital 23. Memoryze tool. 2016 September 17. Available from: https://
Forensics in Cloud Computing Environment, Indian Jour- www.fireeye.com/services/freeware/memoryze.html.
nal of Science and Technology. 2016 May; 9(17):1–7. 24. Dumpit tool.2016 October 27. Available from: http://qp-
20. Sungjin L, Sunghyuck H. Analysis of Time Records on Dig- download.com/dumpit.
ital forensics. Indian Journal of Science and Technology. 25. Wxhexeditor tool.2016 August 25. Available from: https://
2015 Apr; 8(S7):365–72. sourceforge.net/projects/wxhexeditor/.
21. Belkasoft tool. 2016 August 03. Available from: https:// 26. Autopsy tool. 2016 Sep 25. Available from: http://www.
belkasoft.com/ec. sleuthkit.org/autopsy/download.php.
22. Ftkimager tool. 2016 August 24. Available from: https://ac-
cessdata.com/product-download/digital-forensics/ftk-im-
ager-version-3.2.0.

12 Vol 9 (48) | December 2016 | www.indjst.org Indian Journal of Science and Technology