RAM (Random Access Memory) is used to temporarily store working data or code on an active computer. RAM is a snapshot of a live running system and can be captured before the system is shut down. While capturing RAM, investigators and incident responders must bear in mind that it will lead to a change in the state of the system. These changes can include:
- Overwrite of memory for application processing.
- KeyScout will appear in Most Recently used.
RAM analysis will give investigators and incident responders great insight into the running system processes, including processes used by malware. Overall, the contents of RAM may include the following artifacts:
- Evidence of malware intrusion
- Loaded DLLs
- Loaded device drivers
- Open registry keys
- Command history
- Network connections
- Passwords to encrypted volumes and app accounts
- Encryption keys
- Decrypted files and keys
- IP addresses
- Chats, emails and internet history
To capture RAM with Oxygen Forensic® Detective, investigators will need to use the built-in Oxygen Forensic® KeyScout utility. It has the smallest possible footprint and requires no installation.
It’s important to note that maintaining a small footprint without installation helps obtain the most amount of RAM for analysis of the Windows 10 environment. This means investigators will now have access to the full scope of data with Oxygen Forensic® KeyScout.
How it’s done:
Locate Oxygen Forensic® KeyScout on the Home screen of Oxygen forensic® Detective and copy it to a USB drive.
Start Oxygen Forensic® KeyScout on a subject’s computer.
RAM dump can only be created with elevated privileges, such as Admin rights, so before proceeding, the investigator must press the Elevate button on the KeyScout Home screen.
Once you are made Admin, press the “Capture RAM” button to start capturing data. It should be noted, the medium that will hold the data must be of sufficient size.
The utility will then prompt a screen to select the folder in which the dump will be saved.
Once a folder is chosen, RAM capture will start and the progress will be shown in the Memory tab.
The memory (RAM) dump will be created in Raw format that can later be examined by available open-source tools, like Volatility. RAM analysis will be added in a later version of Oxygen Forensic® Detective.
For more information regarding additional capabilities of Oxygen Forensic® KeyScout, read our digital brochure.
