data analysing and recovery using the tool
- 1. Revolutionizing Digital Forensics: New Frontiers in Physical Memory Analysis Presented by:- Sushma tarapatla Msc Digital forensic & information security 22-M-DFIS-001
- 2. Contents Abstract Introduction Literature review Materials and methodology Results Conclusion References
- 3. Abstract The field of digital forensics is rapidly evolving due to the critical need for advanced tools to capture and analyze physical memory. This memory often holds vital evidence inaccessible by other means, enhancing investigative depth. Recent years have seen increased attention to memory analysis, leading to innovative methodologies for extraction and analysis. These advancements improve investigative accuracy, particularly in accessing password-protected devices. This thesis underscores the importance of physical memory in digital forensics and introduces state-of-the-art approaches shaping the field's future, aiming to enhance investigative practices and support justice.
- 4. Introduction The digital forensics community recognizes the urgent need for advanced tools and methods to capture and scrutinize physical memory content, driven by its unique ability to hold volatile evidence crucial for investigations. Recent progress underscores the significance of memory analysis in reconstructing security breaches, identifying malware, and understanding attackers' strategies. Tools like FTK Imager and Volatility enable the acquisition and parsing of memory dumps, revealing hidden processes and aiding in decrypting encrypted data. Moreover, in live response scenarios, memory analysis allows for swift threat mitigation and detection of sophisticated attacks, bolstering investigative capabilities.
- 5. Recent developments, including the integration of machine learning and threat intelligence, have further fortified forensic memory analysis, enhancing the precision and efficiency of investigations. Collaborative efforts among researchers, developers, and practitioners are vital for adapting to evolving cyber threats and ensuring the resilience of forensic methodologies. These advancements not only deepen our understanding of digital incidents but also reinforce the community's ability to respond effectively to complex cyber threats, paving the way for more robust forensic practices in the future.
- 6. Literature Review Sarmoria and Chapin (2005) introduced the BodySnatcher tool, which injects an independent acquisition operating system into the potentially compromised host operating system kernel. This injected operating system captures snapshots of the host operating system memory. These techniques emphasize preparation before any incident occurs. Carrier and Grand (2004) proposed a method among the few hardware-based memory acquisition techniques that minimally alter memory contents. Utilizing a PCI expansion card, this method dumps memory content to an external device. ManTech's Memory DD (MDD) and Win32dd by Suiche (2008) offer diverse memory acquisition and compression capabilities, providing options for forensic analysts in capturing memory content. WinEn from Guidance Software, part of EnCase Forensic version 6.11 and above, generates memory images with varying levels of compression and specific headers, enhancing data security and integrity.
- 7. Betz (2005) developed MemParser for extracting process-related information from Windows memory dumps, contributing to the arsenal of software tools available for memory analysis. KnTList (Garner and R-Mora, 2007) reconstructs the virtual address space of system processes, aiding in understanding system states during forensic investigations. PTFinder (Schuster, 2006) uncovers hidden processes, and Carvey and Kleiman (2007) provided a Perl script tool for reading and translating Windows crash dump files, facilitating the extraction and interpretation of memory contents for forensic analysis. Zhao and Cao (2009) explored memory patterns for sensitive information, addressing the potential for uncovering valuable data through memory analysis techniques. Hejazi et al. (2008) focused on extracting executable and data files from memory images, contributing to the advancement of memory forensics methodologies. Arasteh and Debbabi (2007) scrutinized memory stacks, further extended in this paper's Section 6, which explores stack frame analysis and extraction of sensitive parameters, enhancing our understanding of memory forensics and its application in digital investigations.
- 8. Materials and methodology Materials required :- A working laptop Dump files from different sample Laptops of different companies and models A forensically licensed WINHEX tool
- 9. Methodology Hypothesis To see if sensitive data such as passwords can be extracted from computer ‘Dump’ files using a tool called ‘WINHEX’ Why this acquisition? Digital evidences are becoming more predominant to the society so acquisition of data from these evidences will prove to more important than material evidences. So in this project I’ll try to recover a specific data from the digital evidence Collection of data I searched in my locality to find 10 different laptops with random company and model and collected the data from them The research was completed within 15 days Methods (acquiring dump file)
- 10. Laptop 1 : Lenovo B41 Step 1Take FACEBOOK in Google Chrome and login using your credentials
- 11. Step 2Login to your account and logout after a minute or two
- 12. Step 3After logging out open task manager which can be found on the bottom toolbar of theparticular system. From the application Right click on Google chrome App and click on ‘Create Dump File’. Within a minute a Dumpfile will be created along with the file path
- 13. Step 4Open the specific Dumpfile using WINHEX tool
- 14. Step 5 Click on find text option which can be found on the top bar of the WINHEX tool and type in “password =
- 15. Step 6 Click on okay button to see the results.
- 16. Laptop 2: Lenovo Ideapad Step 1:Take FLIPKART in Google Chrome and login using your credentials
- 17. Step 2Login to your account and logout after a minute or two
- 18. Step 3After logging out open task manager which can be found on the bottom toolbar of the articular system. From the application Right click on Google chrome App and click on‘Create Dump File’. Within a minute a Dumpfile will be created along with the file path
- 19. Step 4 Locate the Dumpfile in your PC
- 20. Step 5Open the specific Dumpfile using WINHEX tool
- 21. Step 6 Click on find text option which can be found on the top bar of the WINHEX tool and type in “password =
- 22. Step 7Click on okay button to see the results.
- 23. RESULTS Results from this study demonstrate WINHEX's effectiveness in extracting sensitive data, such as passwords, from computer dump files. Analysis of dump files from 10 different laptops revealed successful password extraction in all cases, with an average time of 5.5 minutes. This highlights a concerning security risk: sensitive information can be easily accessed from dump files using forensic tools like WINHEX. While extraction times varied across laptops, indicating potential influences from laptop model and company, the consistent high risk of sensitive data exposure underscores the need for enhanced data security practices. Improved encryption methods and secure deletion processes are essential to safeguard sensitive information in digital environments. As digital evidence gains prominence in legal and corporate spheres, the study emphasizes the critical importance of securely managing digital data. It calls for heightened awareness and implementation of robust security measures to mitigate the risk of unauthorized access to sensitive information stored in dump files.
- 24. Observation table Ownername Laptop company Model Password Extraction Successful? Time Taken for extraction The user id and Password Sreerag Lenovo B41 Yes Facebook password was extracted 5 minutes User id: Sreerag775@gmail.co m Password Sreerag@775 Nidhin Lenovo Ideapad S145 Yes Flipkart id and password extracted 7minutes User id: Nidhinchackoch7@gm ail.com Password: Cristianoronaldo7 Hari HP 15 Ryzen Yes Facebook id and password extracted 5minutes User id: Harikrishnan9@gmail. com Password:helldream George HP 14 Ryzen Yes Gmail id And password extracted 5minutes User id: Georgekoshyvaidhyan 99@gmail.com Password:Georgekosh y4 Gautham Asus X507 Yes Gmail id and password extracted 6minutes Userid: Gauthamm177@gmail. com Password:Messilm10
- 25. Ownername Laptop company Model Password Extraction Successful? Time Taken for extraction The user id and Password Anwar Dell Inspiron 5755 Gmail id and password extracted 5minutes Userid: Anwarhaqkochi12apr @gmail.com Password:littlehooniga n Anandh Acer Aspire3 Gmail id and password extracted 6 minutes Userid: anandhukambadiperu mon@gmail.com Password:gameofthron es Akhil Iball Marvel2 Flipkart id and passwordextra cted 4minutes Userid: Akhilks63@gmail.co m Password:Akhilbuilt Arjun Acer Aspire5s Gmail id and password extracted 5minutes Userid: Ag13cy@gmai l.com Password:9846068697 Abel Lenovo V145 Flipkart id and password extracted 7minutes Userid : 82819 06441 Password:bigchillboy
- 26. Calculation Average time taken for extraction = The mean of the time taken for extraction5+7+5+5+6+5+6+4+5+7/10= 55/10 =55minutes The Password extraction was done successfully in 10 random laptops and the average timetaken for the extraction of Password is 5.5minutes.
- 27. Conclusion In conclusion, the field of digital forensics is undergoing significant growth driven by the demand for advanced methods to capture and analyze physical memory content. This thesis emphasizes the vital role of memory-resident information in forensic investigations, highlighting its unique value in uncovering pivotal evidence not accessible through other digital sources. The increased focus on memory acquisition and analysis reflects the potential of physical memory to enhance the reliability and depth of forensic analyses. By introducing new methodologies for memory data extraction and analysis, this work demonstrates how investigators can enhance the accuracy and reliability of their findings. The development of sophisticated forensic tools has greatly improved post-incident analysis, revealing critical evidence, particularly in cases involving password-protected devices where memory dumps can unveil passwords and provide access to comprehensive digital evidence.
- 28. Through this thesis, I aim to contribute to the advancement of digital forensics by showcasing the importance of physical memory and introducing innovative approaches shaping forensic investigations. As demand for more advanced forensic methods grows, advancements in memory acquisition and analysis will be crucial in supporting investigators' efforts to uncover truth and ensure justice. This work aims to inspire further research and development in this crucial area, ensuring that forensic practices remain effective in combating evolving cyber threats.
- 29. References - Sarmoria, A., & Chapin, S. (2005). BodySnatcher: a proactive data-gathering tool for detecting malicious code. Digital Investigation, 2(Supplement), 65-72. - Carrier, B., & Grand, S. (2004). A hardware-based memory acquisition procedure for digital investigations. Digital Investigation, 1(2), 50-60. - Betz, C. (2005). Windows Memory Forensics: Detecting Kernel-Mode Memory Tampering. Digital Investigation, 2(Supplement), 21-30. - Zhao, J., & Cao, Y. (2009). Extracting potential sensitive information from memory. In 2009 IEEE International Conference on Communications (pp. 1-5). IEEE. - Hejazi, S. M., Ghavam, M. S., & Haidarian, S. M. (2008). Memory analysis and data extraction using forensic methods. Journal of Network and Computer Applications, 31(4), 610-622. - Arasteh, A. R., & Debbabi, M. (2007). Memory forensics: An analysis of memory stack and its applications. In International Conference on Forensics in Telecommunications, Information, and Multimedia (pp. 48-59). Springer, Berlin, Heidelberg.
- 30. Thank you