Linux Memory Capture and Analysis - Volatility Tutorial for Linux Memory Forensics
You're likely familiar with many tools that allow us to capture memory from a Windows system. But, have you ever wondered memory capture process for Linux system? And how can you analyse them using Volatility? Well, wait no longer, because that's exactly what we'll cover in this episode! I will show you the easiest process to perform memory capture for a Linux system and how to prepare your volatility tool to parse that memory dump to extract valuable information at the time of doing forensics investigation!
🔗LINKS FOR YOUR REQUIREMENTS-
-------------------------------------------------------------------------------------------------------------------------
👉AVML Tool- https://github.com/microsoft/avml
👉Volatility Tool- https://github.com/volatilityfoundation
🔥🔥🔥🔥🔥
Check-out my Free InfoSec Resource Fusion- https://bit.ly/3vOFarG
🔥🔥🔥🔥🔥
WATCH BELOW AS WELL 🔥🔥🔥🔥🔥
-------------------------------------------------------------------------------------------------------------------------
IR Flash 👉 • How to Collect System Logs within 5 minute...
Access Incident Response Full Training Course👉 https://bit.ly/2OKQaFP
Check out Malware Investigation Part1👉 • Creation of Malware Analysis and Digital F...
Check out Malware Investigation Part2👉 • Malware Analysis Bootcamp - Introduction T...
BlackPerl Forensics Episodes👉 https://bit.ly/3pgpqsG
How do I prepare my timeline👉 • Supply-Chain Attack | Let's Talk SolarWind...
Decoding JavaScript codes for Incident Response👉 • Finding and Decoding Malicious Scripts- Di...
Lean Yara Here 👉 • How to Create Yara || Learn from Scratch w...
🖥
Command We ran in this episode-
-------------------------------------------------------------------------------------------------------------------------
After downloading AVL-
1. file avml
2. chmod 755 avml
3. sudo ./avml memory.raw
Create Volatility Linux Profile-
1. cd ./volatility/tools/linux
2. sudo apt install make
3. sudo apt install gcc
4. sudo apt install dwarfdump
5. sudo zip [distro kernel].zip ./tools/linux/module.dwarf /boot/[kernel version]
6. mv [distro kernel].zip ./volatility/plugins/overlays/linux/
Mount the second volume(the infected machine)-
1. lsblk
2. sudo file -s /dev/xvdf1
3. sudo mkdir /mnt/linux_mount
4. sudo mount -o ro /dev/xvdf1 /mnt/linux_mount
⌚
Timelines
-------------------------------------------------------------------------------------------------------------------------
0:00 ⏩ Intro
1:01 ⏩ Login to Ubuntu VMs
1:51 ⏩ Download AVML & Dump Memory
5:34 ⏩ Download Volatility & Make Linux Profile
16:58 ⏩ Transfer memory dump to forensic workstation
24:39 ⏩ Run Volatility on Linux Memory Dump
26:33 ⏩ Summarize, Automation & TEASER
📞📲
FOLLOW ME EVERYWHERE-
-------------------------------------------------------------------------------------------------------------------------
✔ LinkedIn: / blackperl
✔ You can reach out to me personally in LinkedIn as well- https://bit.ly/38ze4L5
✔ Twitter: @blackperl_dfir
✔ Insta: (blackperl_dfir) / blackperl_dfir
✔ Can be reached via [email protected]
SUPPORT BLACKPERL
-------------------------------------------------------------------------------------------------------------------------
╔═╦╗╔╦╗╔═╦═╦╦╦╦╗╔═╗
║╚╣║║║╚╣╚╣╔╣╔╣║╚╣═╣
╠╗║╚╝║║╠╗║╚╣║║║║║═╣
╚═╩══╩═╩═╩═╩╝╚╩═╩═╝
➡️ SUBSCRIBE, Share, Like, Comment
☕ Buy me a Coffee 👉 https://www.buymeacoffee.com/BlackPerl
📧 Sponsorship Inquiries: [email protected]
-------------------------------------------------------------------------------------------------------------------------
🙏 Thanks for watching!! Be CyberAware!! 🤞
#dfir #linux #volatility #blackperl
On this page of the site you can watch the video online Linux Memory Capture and Analysis - Volatility Tutorial for Linux Memory Forensics with a duration of hours minute second in good quality, which was uploaded by the user BlackPerl 01 January 1970, share the link with friends and acquaintances, this video has already been watched 12,157 times on youtube and it was liked by 183 viewers. Enjoy your viewing!
