Linux Volatile Memory Forensics: Key Caveats in Acquisition and Analysis [PART1]

Background: During the incident containment stage, there may be situations where it is necessary to acquire a volatile dump of RAM from hardware. Since we have already covered memory acquisition on Windows in a previous article, today we will begin a series of articles focused on Linux operating systems.

Toolsets and Their Efficiency for Linux: Let’s review the current scope for scenarios in which we need to acquire volatile memory. Based on this, we can define two assets environment:

1. Single machine environments
   2. Environments with hundreds or more machines

Now that we have defined both types of environments, let’s discuss how, in the context of incident response (IR) for large-scale environments, we can acquire volatile RAM from hundreds of machines—or even just a single machine—without impacting business continuity. To address this challenge, we need to operate at the binary level to ensure that our solution can be deployed across all machines. It is also crucial to ensure that our toolset does not load itself into the kernel, as we have observed with some Windows memory acquisition tools, to avoid contaminating the memory we are trying to capture.

The tools that are available in the current industry can help us in various ways.

• memflow (https://github.com/memflow/memflow)
• dumpit-linux (https://github.com/MagnetForensics/dumpit-linux)
• LiME (https://github.com/504ensicsLabs/LiME)
• avml (https://github.com/microsoft/avml)

In this test we need to put criteria as IR on noted points Efficiency, Scalability, Complexity

memflow Memflow is a Rust framework for volatile memory introspection. To use it effectively, you need a solid understanding of volatile memory structures and objects. With this knowledge, you can develop custom solutions for acquisition at a low level.

dumpit-linux This open-source tool, from a vendor renowned for volatile and non-volatile memory acquisition, does not access the kernel but still produces high-quality memory dumps. And it can be delpoyed over central management into everywehre .

LiME To work with this tool, you need to be very careful because it loads itself at the kernel level. However, before loading, you must build it on the host system, which is not efficient from a performance standpoint.

avml The solution is built with Rust, offering advanced capabilities to acquire memory and upload it to any destination on Azure Blob Storage. It is a highly effective tool.

Compare table

In conclusion, the next step is to define the process for acquiring volatile memory in preparation for the analysis stage.