How do you preserve volatile memory in an incident response?

1 Why is volatile memory important?

Volatile memory can reveal clues about the nature, scope, and impact of a security incident, such as malware infections, unauthorized access, data exfiltration, or lateral movement. It can also help you identify indicators of compromise (IOCs), root causes, and remediation steps. However, volatile memory is also fragile and ephemeral, meaning that it can be overwritten, corrupted, or erased by normal system operations, shutdowns, reboots, or malicious actions. Therefore, preserving volatile memory is a critical task in IR, as it can make the difference between a successful or a failed investigation.

2 When should you preserve volatile memory?

The best time to preserve volatile memory is as soon as possible after detecting or suspecting an incident, before any changes or disruptions occur on the affected system. Ideally, you should preserve volatile memory before performing any other actions on the system, such as disconnecting it from the network, shutting it down, or running antivirus scans. However, in some cases, you may need to prioritize other tasks or consider the risks and benefits of preserving volatile memory, such as the potential impact on business operations, legal obligations, or evidence integrity.

3 How do you preserve volatile memory?

The most common method to preserve volatile memory is to create a memory dump, which is a file that contains a snapshot of the RAM contents at a given point in time. To create a memory dump, you need to use a specialized tool that can access and copy the RAM data without altering or damaging it. There are many tools available for different operating systems and platforms, such as Volatility, FTK Imager, DumpIt, WinPmem, or LiME. Some tools require administrative privileges or kernel drivers, while others can run from a USB drive or a network share. You should always use a trusted and verified tool from a reliable source, and follow the instructions and best practices for each tool.

4 Where do you store the memory dump?

The memory dump file can be very large, depending on the size of the RAM and the level of compression. Therefore, you need to have enough storage space and bandwidth to transfer and store the file securely. You should avoid saving the file on the same system where you created it, as it may compromise the evidence or the system itself. Instead, you should save the file on a separate device, such as a removable drive, a network share, or a cloud service, that is encrypted and protected from unauthorized access. You should also document the location and the details of the file, such as the name, size, hash, and timestamp.

5 How do you analyze the memory dump?

The memory dump file can be analyzed using various tools and techniques, depending on the type of information and evidence you are looking for. Some tools, such as Volatility, can perform a wide range of analysis tasks, such as listing processes, network connections, registry keys, files, or malware. Other tools, such as Rekall, Redline, or Mandiant Memoryze, can provide more specific or advanced features, such as timeline analysis, malware detection, or memory carving. You should always use a copy of the original file for analysis, and keep a record of the commands and results you obtain.

6 What are some challenges and limitations of volatile memory preservation?

Volatile memory preservation is a complex process that can involve certain challenges and limitations, such as not capturing all relevant data, containing sensitive or confidential data that requires special handling, being tampered with or corrupted, and requiring a lot of time, resources, and expertise to create, transfer, store, and analyze. These issues can affect the validity, reliability, efficiency, and effectiveness of the incident response process.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?