The Influence of Virtual Secure Mode (VSM) on Memory Acquisition

Abstract

Recently, acquiring the Random Access Memory (RAM) full memory and access data is gaining significant interest in digital forensics. However, a security feature on the Windows operating system -Virtual Secure Mode (VSM) -presents challenges to the acquisition process by causing a system crash known as a Blue Screen of Death (BSoD). The crash is likely to occur when memory acquisition tools are being used. Subsequently, it disrupts the goal of memory acquisition since the system must be restarted, and the RAM content is no longer available. This study analyzes the implications of VSM on memory acquisition tools as well as examines to what extent its impact on the acquisition process. Two memory acquisition tools, namely FTK Imager and Belkasoft RAM Capturer, were used to conduct the acquisition process. Static and dynamic code analyses were performed by using reverse engineering techniques that are disassembler and debugger. The results were compared based on the percentage of unreadable memory between active and inactive VSM. Static analysis showed that there is no difference between all applications' functions for both active and inactive VSM. Further Bugcheck analysis of the MEMORY.DMP is pointed to the ad_driver.sys module in FTK Imager that causes the system to crash. The percentage of unreadable memory while running on active VSM and inactive VSM for Belkasoft is about 0.6% and 0.0021%, respectively. These results are significant as a reference to digital investigators as consistent with the importance of RAM dump in live forensics.

Static Code Analysis on The Effect of Virtual Secure Mode on Memory Acquisition with IDA

“…These figs implies that the FTK Imager application is running smoothly without any problem found in the operating system. Different between this study, the latest research by Niken [6], it shows that this application cannot run properly in Windows 10 while VSM environment being turned on.…”

“…Other than Autopsy, the experiment on FTK Imager shows that the tools running smoothly for both versions. It leads to comparing this experiment with research by Niken [6], because the result on FTK Imager is different with this study. System analysis method is being applied on FTK Imager and shows that the difference between the edition of Windows 10 can cause different occurrence in the safe mode.…”

“…This study is continuing the research being done by Niken [6]. The purpose is for identifying any new variables that comes up to the related issues.…”

“…Research related to this study is being done by Niken [6]. The research shows that FTK Imager cannot run properly on the device being used.…”