Memory & acquisition #

Acquisition tools

  • Windows: KAPE / Velociraptor (triage; Velociraptor can also pull RAM with Windows.Memory.Acquisition), WinPmem, Magnet RAM Capture, Volexity Surge Collect, F-Response, FTK Imager Lite
  • Linux: AVML (preferred), LiME, UAC for triage
  • macOS: macOS memory is a known-hard problem - Volexity Surge (commercial, best-in-class), avoid user-mode tools post-Catalina; many engagements accept logical + sysdiagnose instead
  • EDR-first: push and pull triage packs through the EDR's live-response channel (Falcon RTR, MDE Live Response, SentinelOne RemoteOps) without logging into the host - see EDR platforms

Analysis

  • Volatility 3 - Windows/Linux/mac. Key plugins: windows.pslist, windows.pstree, windows.cmdline, windows.malfind, windows.handles, windows.ldrmodules, windows.svcscan, windows.netscan, windows.registry.hivelist
  • MemProcFS (Ulf Frisk) - mounts memory as a filesystem; fast triage
  • bulk_extractor, strings for carved PII/credentials
  • Pagefile / hiberfile / swapfile on Windows preserved beyond volatile RAM - collect them with KAPE or Velociraptor
Order of volatility (RFC 3227): CPU regs/cache → network state → RAM → running processes → disk → remote logs → physical media. When a client asks "should we reboot?", the answer is not until memory and volatile state are captured.