It been a while i did'nt talk about Digital Forensic And Incident Response .

As a core part of cybersecurity ; we must know some concepts related to memory dump analysis !

Here is the picture ; i'm gonna show you how we triggers information from your dump files / RAM /USB KEY ............

 

 

 

 

 Let's Dive in with this machine : FORENSICS coming from tryhackme.com

 

1 - Introduction to Memory Dump Analysis

Memory dump analysis is a very important step of the Incident Response process. The RAM (memory) dump of a running compromised machine usually very helpful in reconstructing the events/activities that the attacker performed on the machine.

 

 

So that rude ; to be simple , using a tool called Volatiltity is pretty helpull when doing stuff with memory dump 

If you haven't installed yet , check out this link   https://github.com/volatilityfoundation/volatility3/releases/tag/v2.8.0
 

 

Let's go ! ! ! 

 

 

 

Answer : 

when you installed it succesfull ; do 

    python3 vol.py -f [imagefile] imageInfo 

Note : In some versions like what i'm using , there's no option imageinfo ; 

according to the OS you faced , you have linux.info / window.info .....

Next question : 

Answer : 

python3 vol.py -f [imageinfo] windows.pslist

 

Note : for this question , like if processes tree are multiples ; pipe the ouput of above command with " grep [nameyouwannagrep] "

 

Next Question : 

 

Answer:

My version of volatility doesn't include shellbags yet but here is how to do it so 

    python3 vol.py -f [imageinfo] shellbags

Thanks ! , i will upload the next part later ; i'm running out of coffee

                                                                                            pleasure ; artemis6X