Hi guys, Welcome to the Advanced Video Search Engine, and you are watching Linux Memory Forensics - Memory Capture and Analysis. That video is uploaded by 13Cubed at 2020-07-06T04:33:33-07:00. We are promoting this video only for entertainment and educational purpose only. So, I hope you like & enjoy it. [6Frec5cGzOg]
| Name | Linux Memory Forensics - Memory Capture and Analysis |
| Video Uploader | Video From 13Cubed |
| Upload Date | This Video Uploaded At 06-07-2020 11:33:33 |
| Video Discription | You're likely familiar with many tools that allow us to capture memory from a Windows system, and you may have watched other episodes in which we used Volatility to analyze those captures. But, have you ever wondered how to capture and analyze memory on a Linux system? Well, wait no longer, because that's exactly what we'll cover in this episode! *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 馃摉 Chapters 00:00 - Intro 02:57 - Microsoft AVML 05:14 - Volatility Configuration 09:15 - Volatility Analysis 11:52 - Recap 馃洜 Resources Microsoft AVML: https://github.com/microsoft/avml How to Generate a Volatility Profile for a Linux System: https://www.andreafortuna.org/2019/08/22/how-to-generate-a-volatility-profile-for-a-linux-system/ 馃枼 Commands Used in This Episode Download and run AVML to create memory capture: sudo ./avml memory.dmp Download Volatility: git clone https://github.com/volatilityfoundation/volatility.git Build custom Volatility profile based upon specific Linux kernel version in use: cd ./volatility/tools/linux sudo apt install dwarfdump make cd ../../ uname -a (show current kernel version) sudo zip [DISTRO_KERNEL].zip ./tools/linux/module.dwarf /boot/System.map-[KERNEL VERSION] Install custom Volatility profile: mv [DISTRO_KERNEL].zip ./volatility/plugins/overlays/linux Run Volatility, specifying custom profile, and point at the AVML memory capture: ./vol.py --info | more (verify profile is available) ./vol.py -f /path/to/memory.dmp --profile=[NEW PROFILE NAME] [PLUGIN] #Forensics #DigitalForensics #DFIR #ComputerForensics #LinuxForensics #MemoryForensics 6Frec5cGzOg |
| Category | Science & Technology |
| Tags | forensics | digital forensics | DFIR | memory forensics | Linux forensics | Linux memory forensics | capture memory from Linux | acquire memory from Linux | Microsoft AVML | AVML | AVML Linux | Volatility Linux | Volatility Linux memory | Volatility Linux memory forensics |
