Linux Memory Capture and Analysis - Volatility Tutorial for Linux Memory Forensics
You're likely familiar with many tools that allow us to capture memory from a Windows system. But, have you ever wondered memory capture process for Linux system? And how can you analyse them using Volatility? Well, wait no longer, because that's exactly what we'll cover in this episode! I will show you the easiest process to perform memory capture for a Linux system and how to prepare your volatility tool to parse that memory dump to extract valuable information at the time of doing forensics investigation!
🔗LINKS FOR YOUR REQUIREMENTS-
-------------------------------------------------------------------------------------------------------------------------
👉AVML Tool- https://github.com/microsoft/avml
👉Volatility Tool- https://github.com/volatilityfoundation
🔥🔥🔥🔥🔥
Check-out my Free InfoSec Resource Fusion- https://bit.ly/3vOFarG
🔥🔥🔥🔥🔥
WATCH BELOW AS WELL 🔥🔥🔥🔥🔥
-------------------------------------------------------------------------------------------------------------------------
IR Flash 👉 • How to Collect System Logs within 5 minute...
Access Incident Response Full Training Course👉 https://bit.ly/2OKQaFP
Check out Malware Investigation Part1👉 • Creation of Malware Analysis and Digital F...
Check out Malware Investigation Part2👉 • Malware Analysis Bootcamp - Introduction T...
BlackPerl Forensics Episodes👉 https://bit.ly/3pgpqsG
How do I prepare my timeline👉 • Supply-Chain Attack | Let's Talk SolarWind...
Decoding JavaScript codes for Incident Response👉 • Finding and Decoding Malicious Scripts- Di...
Lean Yara Here 👉 • How to Create Yara || Learn from Scratch w...
🖥
Command We ran in this episode-
-------------------------------------------------------------------------------------------------------------------------
After downloading AVL-
1. file avml
2. chmod 755 avml
3. sudo ./avml memory.raw
Create Volatility Linux Profile-
1. cd ./volatility/tools/linux
2. sudo apt install make
3. sudo apt install gcc
4. sudo apt install dwarfdump
5. sudo zip [distro kernel].zip ./tools/linux/module.dwarf /boot/[kernel version]
6. mv [distro kernel].zip ./volatility/plugins/overlays/linux/
Mount the second volume(the infected machine)-
1. lsblk
2. sudo file -s /dev/xvdf1
3. sudo mkdir /mnt/linux_mount
4. sudo mount -o ro /dev/xvdf1 /mnt/linux_mount
⌚
Timelines
-------------------------------------------------------------------------------------------------------------------------
0:00 ⏩ Intro
1:01 ⏩ Login to Ubuntu VMs
1:51 ⏩ Download AVML & Dump Memory
5:34 ⏩ Download Volatility & Make Linux Profile
16:58 ⏩ Transfer memory dump to forensic workstation
24:39 ⏩ Run Volatility on Linux Memory Dump
26:33 ⏩ Summarize, Automation & TEASER
📞📲
FOLLOW ME EVERYWHERE-
-------------------------------------------------------------------------------------------------------------------------
✔ LinkedIn: / blackperl
✔ You can reach out to me personally in LinkedIn as well- https://bit.ly/38ze4L5
✔ Twitter: @blackperl_dfir
✔ Insta: (blackperl_dfir) / blackperl_dfir
✔ Can be reached via [email protected]
SUPPORT BLACKPERL
-------------------------------------------------------------------------------------------------------------------------
╔═╦╗╔╦╗╔═╦═╦╦╦╦╗╔═╗
║╚╣║║║╚╣╚╣╔╣╔╣║╚╣═╣
╠╗║╚╝║║╠╗║╚╣║║║║║═╣
╚═╩══╩═╩═╩═╩╝╚╩═╩═╝
➡️ SUBSCRIBE, Share, Like, Comment
☕ Buy me a Coffee 👉 https://www.buymeacoffee.com/BlackPerl
📧 Sponsorship Inquiries: [email protected]
-------------------------------------------------------------------------------------------------------------------------
🙏 Thanks for watching!! Be CyberAware!! 🤞
#dfir #linux #volatility #blackperl
En esta página del sitio puede ver el video en línea Linux Memory Capture and Analysis - Volatility Tutorial for Linux Memory Forensics de Duración hora minuto segunda en buena calidad , que subió el usuario BlackPerl 01 enero 1970, comparta el enlace con amigos y conocidos, en youtube este video ya ha sido visto 12,157 veces y le gustó 183 a los espectadores. Disfruta viendo!
