Recovery of Encryption Keys from Memory Using a Linear Scan

Abstract

As encrypted containers are encountered more frequently the need for live imaging is likely to increase. However, an acquired live image of an open encrypted file system cannot later be verified against any original evidence, since when the power is removed the decrypted contents are no longer accessible. This paper shows that if a memory image is also obtained at the same time as the live container image, by the design of on-the-fly encryption, decryption keys can be recovered from the memory dump. These keys can then be used offline to gain access to the encrypted container file, facilitating standard, repeatable, forensic file system analysis. The recovery method uses a linear scan of memory to generate trial keys from all possible memory positions to decrypt the container. The effectiveness of this approach is demonstrated by recovering TrueCrypt decryption keys from a memory dump of a Windows XP system.The Third International Conference on Availability, Reliability and Security 0-7695-3102-4/08 $25.00

Windows Vista and digital investigations

“…However, the potential problems of using live images from encrypted systems are highlighted in Hargreaves and Chivers (2008), since the accuracy of the acquired image cannot be verified by comparing to an original. Therefore, in addition to obtaining disk images from a live system, it is also possible to create backup copies of the start-up or recovery keys by accessing the 'Manage BitLocker Keys' interface through the Control Panel, as shown in Fig.…”

Research toward a Partially-Automated, and Crime Specific Digital Triage Process Model

“…It is most commonly used during incident response to attempt a determination of how a machine was compromised. However, live forensics is likely to become more important and more common as users become familiar with and operating systems come standard with full disk encryption as it can be vital to circumventing such encryption (Casey & Stellatos, 2008;Hargreaves & Chivers, 2008).…”

PMCAP: A Threat Model of Process Memory Data on the Windows Operating System

“…In this case, we may achieve a low false alarm rate. In fact, the method of brute force memory scanning has been used in memory forensics [28]. It has to overcome the difficulties of large address space and unclear goals.…”

“…More specifically it first uses hardware card, virtualization, and applications at different levels including user level and kernel level. To acquire memory [15], Hargreaves and Chivers proposed a method for recovering the decryption keys from the memory using linear scan [28]. Sylve et al proposed a novel technique for locating kernel object allocations with quick pool tag scanning [17], which has a good performance in the large memory space.…”

“…while < do (8) if matches .V then (9) ← +AP.offset; (10) Extracting data from ; (11) Saving data to ; (12) end if (13) + +; (14) end while (15) end for (16) return (17) end function (18) (19) function GetThread( , TF) (20) Finding PEB address ; (21) Finding TEB addresses _array based on ; (22) for all in _array do (23) Reading the stack base _ from ; (24) Reading the stack limit _ from ; (25) calculate size and read the stack buffer _buf ; (26) ← _ ; (27) while < _ do (28) if matches the value in TF then (29) save _ and _ to ℎ ; (30) end if (31) + +; (32) end while (33) end for (34) return ℎ (35) end function (FAR), it denotes the interference of the irrelevant objects in the extracted objects, and (c) average CPU time (ACT), it is the CPU usage of the search thread on the target system. The method based on vtable pointer characteristic searches in the virtual memory space.…”