Linux Memory Capture and Analysis - Volatility Tutorial for Linux Memory Forensics

You're likely familiar with many tools that allow us to capture memory from a Windows system. But, have you ever wondered memory capture process for Linux system? And how can you analyse them using Volatility? Well, wait no longer, because that's exactly what we'll cover in this episode! I will show you the easiest process to perform memory capture for a Linux system and how to prepare your volatility tool to parse that memory dump to extract valuable information at the time of doing forensics investigation!
🔗LINKS FOR YOUR REQUIREMENTS-
-------------------------------------------------------------------------------------------------------------------------
👉AVML Tool- github.com/microsoft/avml
👉Volatility Tool- github.com/volatilityfoundation
🔥🔥🔥🔥🔥
Check-out my Free InfoSec Resource Fusion- bit.ly/3vOFarG
🔥🔥🔥🔥🔥
WATCH BELOW AS WELL 🔥🔥🔥🔥🔥
-------------------------------------------------------------------------------------------------------------------------
IR Flash 👉 • How to Collect System ...
Access Incident Response Full Training Course👉 bit.ly/2OKQaFP
Check out Malware Investigation Part1👉 • Creation of Malware An...
Check out Malware Investigation Part2👉 • Malware Analysis Bootc...
BlackPerl Forensics Episodes👉 bit.ly/3pgpqsG
How do I prepare my timeline👉 • Supply-Chain Attack | ...
Decoding JavaScript codes for Incident Response👉 • Finding and Decoding M...
Lean Yara Here 👉 • How to Create Yara || ...
🖥
Command We ran in this episode-
-------------------------------------------------------------------------------------------------------------------------
After downloading AVL-
1. file avml
2. chmod 755 avml
3. sudo ./avml memory.raw
Create Volatility Linux Profile-
1. cd ./volatility/tools/linux
2. sudo apt install make
3. sudo apt install gcc
4. sudo apt install dwarfdump
5. sudo zip [distro kernel].zip ./tools/linux/module.dwarf /boot/[kernel version]
6. mv [distro kernel].zip ./volatility/plugins/overlays/linux/
Mount the second volume(the infected machine)-
1. lsblk
2. sudo file -s /dev/xvdf1
3. sudo mkdir /mnt/linux_mount
4. sudo mount -o ro /dev/xvdf1 /mnt/linux_mount
⌚
Timelines
-------------------------------------------------------------------------------------------------------------------------
0:00 ⏩ Intro
1:01 ⏩ Login to Ubuntu VMs
1:51 ⏩ Download AVML & Dump Memory
5:34 ⏩ Download Volatility & Make Linux Profile
16:58 ⏩ Transfer memory dump to forensic workstation
24:39 ⏩ Run Volatility on Linux Memory Dump
26:33 ⏩ Summarize, Automation & TEASER
📞📲
FOLLOW ME EVERYWHERE-
-------------------------------------------------------------------------------------------------------------------------
✔ LinkedIn: / blackperl
✔ You can reach out to me personally in LinkedIn as well- bit.ly/38ze4L5
✔ Twitter: @blackperl_dfir
✔ Insta: (blackperl_dfir) / blackperl_dfir
✔ Can be reached via [e-mail]
SUPPORT BLACKPERL
-------------------------------------------------------------------------------------------------------------------------
╔═╦╗╔╦╗╔═╦═╦╦╦╦╗╔═╗
║╚╣║║║╚╣╚╣╔╣╔╣║╚╣═╣
╠╗║╚╝║║╠╗║╚╣║║║║║═╣
╚═╩══╩═╩═╩═╩╝╚╩═╩═╝
➡️ SUBSCRIBE, Share, Like, Comment
☕ Buy me a Coffee 👉 www.buymeacoffee.com/BlackPerl
📧 Sponsorship Inquiries: [e-mail]
-------------------------------------------------------------------------------------------------------------------------
🙏 Thanks for watching!! Be CyberAware!! 🤞
#dfir #linux #volatility #blackperl

[@cararose2987]

Amazing content. This will help to prepare the forensics runbook right away for us! Thanks for making it. Looking forward for more linux contents..

[@BlackPerl]

Thank you for the feedback! Please stay tuned!

[@debabratabandyopadhyay8319]

The intro is amazing!! Great!!

[@BlackPerl]

Thank you!

[@debjanibanerjee4373]

Lovely Episode!!

[@montyhell6726]

Changing any thing in the infected can lead to loss of evidence ,is it true?? If so you said running an apt command can change lot and sometime ask for a reboot also .so is it a recommended action to reboot the server before taking memory dump or change any parameters as it can flush the TCP dump also ?

[@BlackPerl]

Yes, you are right.. Changing things in evidence system might have a chance to override potential data which might create issues later while doing investigation.
And you should never do a reboot before capturing memory dump. For my case, since I was starting fresh I did a apt get update, but in actual world and incident, you MUST not do it. You can just dump the AVML file and run it. Running AVML won't push much fingerprint on the system and it works in kernel mode, so not much will be shifted from memory, so we are good!

[@muralimohan4938]

Good Episode.
you can make a video on the tool redline also.

[@BlackPerl]

Thanks for the suggestion, Buddy. Will do.

[@carlosdanielbedoyramos4419]

help, how do I do the same analysis with python 3?

[@BlackPerl]

You need to use Volatility3 if you want to use python3. Volatility2 doesn't support python3, I believe

[@carlosdanielbedoyramos4419]

@@BlackPerl
Yes, I understand the point, I have analyzed wundows ram dumps with volatility3, but I have not been able to analyze linux ram dumps with volatility3. Have you done it? Thanks for your answer

[@BlackPerl]

@@carlosdanielbedoyramos4419 No, I don't use vol3 much since it's still in early stage, so not matured enough

[@bitsworld6721]

Hi i was following your tutorial but stuck on zip file parsing i am getting the error , i think the issues with system kernel name , please advise
sudo zip kali_5.17.0-kali3-cloud-amd64.zip ./volatility/tools/linux/module.dwarf /boot/System.map 5.17.0-kali3-cloud-amd64
zip warning: name not matched: /boot/System.map
zip warning: name not matched: 5.17.0-kali3-cloud-amd64
adding: volatility/tools/linux/module.dwarf (deflated 91%)

[@BlackPerl]

It seems to be a warning and not a hard error. Please try using the profile with a memory dump. Also, make sure you have the correct name in of system map under /boot directory

[@bitsworld6721]

@@BlackPerl Thanks its working yes its correct name in of system map

[@securitybyte1695]

Why make a snap shot and etc to do the memory dump file transfer . why not just transfer it normally like using a python http server.

[@BlackPerl]

Yes, you can transfer any way you like. But at times, your fileight be 10GB or more, so transferring via online server will take huge amount of time. Also, your compliance will not support sending data through internet.
So the easiest and safest option is to take snapshot and do within aws

[@jotunheim1491]

This does not work for Linux Ubuntu22.04 though. It works until 18.04, maybe 20.04

[@BlackPerl]

Need to make small configuration change in make file. It will work

[@futurebuddies5335]

OMG!! Are you THOR ? LOL..

[@futurebuddies5335]

Anyway, Awesome representation Buddy!!

[@BlackPerl]

@@futurebuddies5335 Thanks Buddy!

[@smurfcoder391]

Did he just say "Lin-Axe"?

[@adam-atasi]

The first English word that Indians learn is "particular". Then they use it 3 times in every sentence. Even if the sentence has 5 words.

[@BlackPerl]

Lol.