Hi guys, Welcome to the Advanced Video Search Engine, and you are watching Linux Memory Capture and Analysis - Volatility Tutorial for Linux Memory Forensics. That video is uploaded by BlackPerl at 2021-05-16T06:30:15-07:00. We are promoting this video only for entertainment and educational purpose only. So, I hope you like & enjoy it. [eK-Y6MyMKVE]
| Name | Linux Memory Capture and Analysis - Volatility Tutorial for Linux Memory Forensics |
| Video Uploader | Video From BlackPerl |
| Upload Date | This Video Uploaded At 16-05-2021 13:30:15 |
| Video Discription | You're likely familiar with many tools that allow us to capture memory from a Windows system. But, have you ever wondered memory capture process for Linux system? And how can you analyse them using Volatility? Well, wait no longer, because that's exactly what we'll cover in this episode! I will show you the easiest process to perform memory capture for a Linux system and how to prepare your volatility tool to parse that memory dump to extract valuable information at the time of doing forensics investigation! ๐LINKS FOR YOUR REQUIREMENTS- ------------------------------------------------------------------------------------------------------------------------- ๐AVML Tool- https://github.com/microsoft/avml ๐Volatility Tool- https://github.com/volatilityfoundation ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ Check-out my Free InfoSec Resource Fusion- https://bit.ly/3vOFarG ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ WATCH BELOW AS WELL ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ ------------------------------------------------------------------------------------------------------------------------- IR Flash ๐ https://youtu.be/6kOinwAB-BY Access Incident Response Full Training Course๐ https://bit.ly/2OKQaFP Check out Malware Investigation Part1๐ https://youtu.be/E86wyomzDjs Check out Malware Investigation Part2๐ https://youtu.be/D3inDM8kM-Y BlackPerl Forensics Episodes๐ https://bit.ly/3pgpqsG How do I prepare my timeline๐ https://youtu.be/KJpWxbNoWp8 Decoding JavaScript codes for Incident Response๐ https://youtu.be/rot9cDW9SYA Lean Yara Here ๐ https://youtu.be/DI5zV_vGJC0 ๐ฅ Command We ran in this episode- ------------------------------------------------------------------------------------------------------------------------- After downloading AVL- 1. file avml 2. chmod 755 avml 3. sudo ./avml memory.raw Create Volatility Linux Profile- 1. cd ./volatility/tools/linux 2. sudo apt install make 3. sudo apt install gcc 4. sudo apt install dwarfdump 5. sudo zip [distro kernel].zip ./tools/linux/module.dwarf /boot/[kernel version] 6. mv [distro kernel].zip ./volatility/plugins/overlays/linux/ Mount the second volume(the infected machine)- 1. lsblk 2. sudo file -s /dev/xvdf1 3. sudo mkdir /mnt/linux_mount 4. sudo mount -o ro /dev/xvdf1 /mnt/linux_mount โ Timelines ------------------------------------------------------------------------------------------------------------------------- 0:00 โฉ Intro 1:01 โฉ Login to Ubuntu VMs 1:51 โฉ Download AVML & Dump Memory 5:34 โฉ Download Volatility & Make Linux Profile 16:58 โฉ Transfer memory dump to forensic workstation 24:39 โฉ Run Volatility on Linux Memory Dump 26:33 โฉ Summarize, Automation & TEASER ๐๐ฒ FOLLOW ME EVERYWHERE- ------------------------------------------------------------------------------------------------------------------------- โ LinkedIn: https://www.linkedin.com/company/blackperl โ You can reach out to me personally in LinkedIn as well- https://bit.ly/38ze4L5 โ Twitter: @blackperl_dfir โ Insta: (blackperl_dfir)https://www.instagram.com/blackperl_dfir/ โ Can be reached via blackperl_dfir@yahoo.com SUPPORT BLACKPERL ------------------------------------------------------------------------------------------------------------------------- โโโฆโโโฆโโโโฆโโฆโฆโฆโฆโโโโ โโโฃโโโโโฃโโฃโโฃโโฃโโโฃโโฃ โ โโโโโโโ โโโโฃโโโโโโโฃ โโโฉโโโฉโโฉโโฉโโฉโโโฉโโฉโโ โก๏ธ SUBSCRIBE, Share, Like, Comment โ Buy me a Coffee ๐ https://www.buymeacoffee.com/BlackPerl ๐ง Sponsorship Inquiries: archan.fiem.it@gmail.com ------------------------------------------------------------------------------------------------------------------------- ๐ Thanks for watching!! Be CyberAware!! ๐ค #dfir #linux #volatility #blackperl eK-Y6MyMKVE |
| Category | Science & Technology |
| Tags | memory capture | memory capture tools | memory capture forensic | forensics | linux forensics | capture memory from linux | volatility linux memory | volatility linux | linux memory acquisition | Linux memory capture | volatility linux profiles | volatility linux memory dump | volatility linux memory analysis | volatility linux install | linux memory analysis | volatility memory forensics | forensic acquisition | memory forensics | dfir training | linux memory forensics | volatility tutorial |
