A universal taxonomy and survey of forensic memory acquisition techniques

Latzo, Tobias; Palutke, Ralph; Freiling, Felix C.

doi:10.1016/j.diin.2019.01.001

Cited by 25 publications

(14 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Hence, the acquired memory image is also unreliable. Latzo et al confirmed that the lower the execution layer of the acquisition method, the higher the accuracy of the acquired memory image [26]. Therefore, we propose a memory layout acquisition method that can cope with the existing API hooking and one-byte modification attacks.…”

Section: Considerationmentioning

confidence: 95%

Memory Layout Extraction and Verification Method for Reliable Physical Memory Acquisition

et al. 2021

View full text Add to dashboard Cite

Physical memory acquisition is a prerequisite when performing memory forensics, referring to a set of techniques for acquiring and analyzing traces associated with user activity information, malware analysis, cyber incident response, and similar areas when the traces remain in the physical RAM. However, certain types of malware have applied anti-memory forensics techniques to evade memory analysis strategies or to make the acquisition process impossible. To disturb the acquisition process of physical memory, an attacker hooks the kernel API, which returns a map of the physical memory spaces, and modifies the return value of the API, specifically that typically used by memory acquisition tools. Moreover, an attacker modifies the kernel object referenced by the kernel API. This causes the system to crash during the memory acquisition process or causes the memory acquisition tools to incorrectly proceed with the acquisition. Even with a modification of one byte, called a one-byte modification attack, some tools fail to acquire memory. Therefore, specialized countermeasure techniques are needed for these anti-memory forensics techniques. In this paper, we propose a memory layout acquisition method which is robust to kernel API hooking and the one-byte modification attack on NumberOfRuns, the kernel object used to construct the memory layout in Windows. The proposed acquisition method directly accesses the memory, extracts the byte array, and parses it in the form of a memory layout. When we access the memory, we extract the _PHYSICAL_MEMORY_DESCRIPTOR structure, which is the basis of the memory layout without using the existing memory layout acquisition API. Furthermore, we propose a verification method that selects a reliable memory layout. We realize the verification method by comparing NumberOfRuns and the memory layout acquired via the kernel API, the registry, and the proposed method. The proposed verification method guarantees the reliability of the memory layout and helps secure memory image acquisition through a comparative verification with existing memory layout acquisition methods. We also conduct experiments to prove that the proposed method is resistant to anti-memory forensics techniques, confirming that there are no significant differences in time compared to the existing tools.

show abstract

Section: Considerationmentioning

confidence: 95%

Memory Layout Extraction and Verification Method for Reliable Physical Memory Acquisition

et al. 2021

View full text Add to dashboard Cite

show abstract

“…Usually, such data are not stored in the permanent storage of the system and are completely lost when the system is turned off or unplugged from the power. In the literature, we can find surveys devoted to the analysis of the memory acquisition techniques [62], [63] (i.e., both hardware and software-based), the subsequent memory analysis [64], and the available tools [63]. The main challenges of memory forensics derive from the fact that memory is volatile, so it has to be acquired when the system is running and thus probably modified by the running applications.…”

Section: E Filesystems Memory and Data Storage Forensicsmentioning

confidence: 99%

“…Another issue that can occur during the memory acquisition is the incorporation of pages, which are not present in the memory due to page swapping or demand paging [64]. Finally, although the memory acquisition techniques should be OS and hardware agnostic [62], each OS architecture handles the memory differently and is equipped with distinctive tampering protection mechanisms that hinder access to memory.…”

Section: E Filesystems Memory and Data Storage Forensicsmentioning

confidence: 99%

“…Not standard logging features and settings [61], [65]- [70], [73], [75] No validation/verification in real-life scenarios and large datasets [72], [74] Subjectivity of the evaluation of content retrieval algorithms [72], [74] Advanced knowledge and training of analysts and investigators [69], [72] Lack of guidance for investigators regarding selective search and seize. Subjectivity of search terms based on investigator's experience [69], [74] Difficulty to apply low-level analysis techniques, hindering correctness of the results [62], [70] Sophisticated malware implementing antiforensic techniques [61]- [63], [74] Volatile data acquisition due to hardware constraints [71] Stealthy non-memory-resident malware [64] Handling, execution and monitoring of memory [61], [63], […”

Section: Challenge/limitation Referencesmentioning

confidence: 99%

See 1 more Smart Citation

Research Trends, Challenges, and Emerging Topics in Digital Forensics: A Review of Reviews

et al. 2022

View full text Add to dashboard Cite

This work was supported by the European Commission under the Horizon 2020 Programme (H2020), as part of the projects LOCARD (https://locard.eu) (Grant Agreement no. 832735) and CyberSec4Europe (https://www.cybersec4europe.eu) (Grant Agreement no. 830929). F. Casino was supported by the Beatriu de Pinós programme of the Government of Catalonia (Grant No. 2020 BP 00035). The content of this article does not reflect the official opinion of the European Union. Responsibility for the information and views expressed therein lies entirely with the authors.

show abstract

“…This is used to start-up and speed-up a window machine program. In [111], Latzo et al surveyed the memory forensics domain and presented a forensics memory acquisition taxonomy that is independent of the Operating System (OS) and the Hardware Architecture (HA), and can also be deployed pre/post-incident.…”

Section: Memory Forensics Approachesmentioning

confidence: 99%

Digital Forensics vs. Anti-Digital Forensics: Techniques, Limitations and Recommendations

Yaacoub,

Noura,

Salman

et al. 2021

Preprint

View full text Add to dashboard Cite

The number of cyber attacks has increased tremendously in the last few years. This resulted into both human and financial losses at the individual and organization levels. Recently, cyber-criminals are leveraging new skills and capabilities by employing anti-forensics activities, techniques and tools to cover their tracks and evade any possible detection. Consequently, cyber-attacks are becoming more efficient and more sophisticated. Therefore, traditional cryptographic and non-cryptographic solutions and access control systems are no longer enough to prevent such cyber attacks, especially in terms of acquiring evidence for attack investigation. Hence, the need for well-defined, sophisticated, and advanced forensics investigation tools are highly required to track down cyber criminals and to reduce the number of cyber crimes. This paper reviews the different forensics and anti-forensics methods, tools, techniques, types, and challenges, while also discussing the rise of the anti-anti-forensics as a new forensics protection mechanism against anti-forensics activities. This would help forensics investigators to better understand the different anti-forensics tools, methods and techniques that cyber criminals employ while launching their attacks. Moreover, the limitations of the current forensics techniques are discussed, especially in terms of issues and challenges. Finally, this paper presents a holistic view from a literature point of view over the forensics domain and also helps other fellow colleagues in their quest to further understand the digital forensics domain.

show abstract

A universal taxonomy and survey of forensic memory acquisition techniques

Cited by 25 publications

References 10 publications

Memory Layout Extraction and Verification Method for Reliable Physical Memory Acquisition

Memory Layout Extraction and Verification Method for Reliable Physical Memory Acquisition

Research Trends, Challenges, and Emerging Topics in Digital Forensics: A Review of Reviews

Digital Forensics vs. Anti-Digital Forensics: Techniques, Limitations and Recommendations

Contact Info

Product

Resources

About