Hi, just thought I'd share this, since it took me an hour or two of
googling to figure out. I wanted to take a VMWare disk I had for
testing and mount it so that I could get the hibernation file off to
use with Sandman.
If you're on Linux, you can just use vmware-mount.pl to mount the
vmware disk.
If you're on Windows, you can use vmware-mount for that platform:
http://www.vmware.com/pdf/VMwareDiskMount.pdf
If you just want to mount a dd image on OS X, skip to step 3.
Step 1: Get the OS X version of QEMU at http://www.kju-app.org/kju/ ,
which comes with qemu-img, which can convert between VMDK and raw
disk images.
Step 2: Convert the VMDK image to a raw disk image:
azzurra:~ moyix$ /Applications/Q.app/Contents/MacOS/qemu-img convert -
f vmdk WindowsXpProfessional-000001.vmdk ~/xpsp2_img.raw
Step 3: Use the fdisk to determine where the partition you want to
mount starts. In this case I want the NTFS (called HPFS by fdisk)
partition, which fdisk says starts at sector 63.
azzurra:~ moyix$ fdisk ~/xpsp2_img.raw
Disk: /Users/moyix/xpsp2_img.raw geometry: 0/4/63 [0 sectors]
Signature: 0xAA55
Starting Ending
#: id cyl hd sec - cyl hd sec [ start - size]
----------------------------------------------------------
*1: 07 0 1 1 - 1023 254 63 [ 63 - 41913522] HPFS/QNX/AUX
2: 00 0 0 0 - 0 0 0 [ 0 - 0] unused
3: 00 0 0 0 - 0 0 0 [ 0 - 0] unused
4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused
Step 4: Use hdid to attach the image as a block device. It outputs the
device it attaches it to.
azzurra:~ moyix$ hdid -section 63 -nomount -imagekey diskimage-
class=CRawDiskImage ~/xpsp2_img.raw
/dev/disk1
Step 5: Mount the resulting block device with the appropriate
filesystem mounter.
azzurra:~ moyix$ sudo mount_ntfs /dev/disk1 /mnt/ntfs_fs/
Step 6: When you're done, unmount the FS and detach the block device:
azzurra:~ moyix$ sudo umount /mnt/ntfs_fs/
azzurra:~ moyix$ hdiutil detach /dev/disk1
Hope this helps someone,
Brendan
vol-users,
Some of you may have noticed that Matthieu Suiche just released a tool for
converting hiberfil.sys to a physical memory dump.
http://www.msuiche.net/2008/02/26/sandman-10080226-is-out/
We have added support for Sandman generated images of physical memory in
the upcoming Volatility 1.3 release. If you would like to play with it
before then, I have attached a patch for Volatility-1.1.1. If you get a
chance, give it a try. Please let us know, if you have any problems with
the Volatility modules!
cd Volatility-1.1.1
patch -p1 <Volatility-1.1.1.hiber.patch
Thanks,
AW
vol-users,
Once again, Brendan Dolan-Gavitt has another great blog entry. I highly
recommend you adding his blog to your feeds. In this entry, he discusses
extracting registry data from volatile memory. Granted, I'm also a little
biased since it was implemented within Volatility. Brendan is a major
contributor to the Volatility community! Powered by the people.
http://moyix.blogspot.com/2008/02/cell-index-translation.html
Thanks,
AW
Vol-users,
We are getting ready for the next release of Volatility. If you have any
bugs you would like to see fixed, modules you would like to see added,
code you would like to contribute, or general suggestions, please let us
know! There are a number of new and exciting changes in the pipeline.
A special thanks to all those who have already provided feedback either
through email or on IRC.
Thanks,
AW
The American Academy of Forensic Sciences has recently posted program
information for the 2008 Annual Meeting. There are a number of
interesting talks during the Digital Evidence Session. The session
program can be found under the General Scientific Sessions Schedules
(http://www.aafs.org/pdf/08General.pdf) In particular, we will presenting
on our collaborative effort with NIST:
"Using Hashing to Improve Volatile Memory Forensic Analysis", AAron R.
Walters, MS*; Blake Matheny, BS; Douglas White, MS
Thanks,
AW
It was only a matter of time....
In case you might have missed it during the holidays, the latest version
of PyFlag now leverages the Volatility Framework to add volatile memory
analysis to it's outstanding list of capabilities. As a result, making
PyFlag the first and only tool publically available that allows the
digital investigator to correlate disk images, log files, network traffic,
and RAM captures all within an intuitive interface. While the current
functionality is still preliminary, just imagine the possibilities!
Since PyFlag loads memory images through its standard IO source interface,
it is also now possible to store your memory images using the EWF format,
commonly used in commercial tools. Once the memory image is uploaded to
PyFlag, information can either be accessed through a browseable /proc
interface or through the Stats view. Michael Cohen and his team have
provided a tutorial and image to get you started:
http://www.pyflag.net/cgi-bin/moin.cgi/MemoryForensicsTutorial
As I mentioned in a previous post, a special thanks to Europol for
bringing our teams together through the High Tech Crime Expert Meeting.
I also want to thank Michael Cohen for the great work he has done with
PyFlag and his contributions to Volatility! Stay tuned for further
exciting collaborations and future Volatility releases in 2008!
Thanks,
AW
Hello,
I was just running Volatility on a couple of Linux boxes and received quite
different results. I have tested this on two other boxes to verify the
results and it seems to be a dual core issue.
Here is the expected output on a single core system:
$ cat /proc/version
Linux version 2.6.22.9-91.fc7
$ python -V
Python 2.5
$ Volatility-1.1.1/volatility pslist -f image.vmem
Name Pid PPid Thds Hnds Time
System 4 0 44 182 Thu Jan 01 00:00:00 1970
smss.exe 336 4 3 21 Mon Oct 29 19:23:16 2007
csrss.exe 392 336 9 287 Mon Oct 29 19:23:18 2007
winlogon.exe 416 336 24 453 Mon Oct 29 19:23:19 2007
services.exe 460 416 19 371 Mon Oct 29 19:23:20 2007
lsass.exe 472 416 26 319 Mon Oct 29 19:23:20 2007
svchost.exe 640 460 10 210 Mon Oct 29 19:23:21 2007
svchost.exe 684 460 79 1023 Mon Oct 29 19:23:21 2007
svchost.exe 780 460 4 67 Mon Oct 29 19:23:22 2007
svchost.exe 812 460 12 141 Mon Oct 29 19:23:23 2007
userinit.exe 1000 416 2 32 Mon Oct 29 19:23:25 2007
explorer.exe 1020 1000 12 231 Mon Oct 29 19:23:25 2007
spoolsv.exe 1048 460 6 37 Mon Oct 29 19:23:25 2007
msmsgs.exe 1468 1020 5 124 Mon Oct 29 19:23:33 2007
rundll32.exe 1524 1020 1 72 Mon Oct 29 19:23:37 2007
And here is the output from a dual core system:
$ cat /proc/version
Linux version 2.6.9-55.0.12.ELsmp
$ python -V
Python 2.3.4
$ Volatility-1.1.1/volatility pslist -f image.vmem
/home/jlevy/forensic/Volatility-1.1.1/forensics/x86.py:101: FutureWarning:
x<<y losing bits or changing sign will return a long in Python 2.4 and up
return (pgd_entry & ((ptrs_per_pgd-1) << 22)) | (vaddr &
~((ptrs_per_pgd-1) << 22))
Name Pid PPid Thds Hnds Time
System 4 0 44 182 Thu Jan 01 00:00:00 1970
/home/jlevy/forensic/Volatility-1.1.1/forensics/win32/datetime.py:58:
FutureWarning: x<<y losing bits or changing sign will return a long in
Python 2.4 and up
return (high_time << 32) | low_time
smss.exe 336 4 3 21 Thu Jan 01 00:00:00 1970
csrss.exe 392 336 9 287 Thu Jan 01 00:00:00 1970
winlogon.exe 416 336 24 453 Thu Jan 01 00:00:00 1970
services.exe 460 416 19 371 Thu Jan 01 00:00:00 1970
lsass.exe 472 416 26 319 Thu Jan 01 00:00:00 1970
svchost.exe 640 460 10 210 Thu Jan 01 00:00:00 1970
svchost.exe 684 460 79 1023 Thu Jan 01 00:00:00 1970
svchost.exe 780 460 4 67 Thu Jan 01 00:00:00 1970
svchost.exe 812 460 12 141 Thu Jan 01 00:00:00 1970
userinit.exe 1000 416 2 32 Thu Jan 01 00:00:00 1970
explorer.exe 1020 1000 12 231 Thu Jan 01 00:00:00 1970
spoolsv.exe 1048 460 6 37 Thu Jan 01 00:00:00 1970
msmsgs.exe 1468 1020 5 124 Thu Jan 01 00:00:00 1970
rundll32.exe 1524 1020 1 72 Thu Jan 01 00:00:00 1970
$ Volatility-1.1.1/volatility vaddump -f image.vmem
/home/jlevy/forensic/Volatility-1.1.1/forensics/x86.py:101: FutureWarning:
x<<y losing bits or changing sign will return a long in Python 2.4 and up
return (pgd_entry & ((ptrs_per_pgd-1) << 22)) | (vaddr &
~((ptrs_per_pgd-1) << 22))
The above errors on the dual system have been observed on a dual core laptop
running Ubuntu as well... I was wondering if others have seen this, and if
there is a work around yet?
During the course of a day, I typically come across a number of useful
"things" related to volatile memory analysis. Often, I don't have the time
to post a complete blog entry so I've decided to start a tumblelog:
http://volatility.tumblr.com/
In particular, you may want to check out the hypothetical dialog between a
defense attorney and a forensic examiner about volatile memory.
http://volatility.tumblr.com/post/15164622
By the way, if any of you are interested in what is happening with
Volatility development. We are getting ready to release Volatility 1.2. We
mentioned it on the vol-dev list a couple of weeks ago:
http://www.volatilityfoundation.org/pipermail/vol-dev/2007-September/000001…
I would especially like to thank both Brendan Dolan-Gavitt and Andreas
Schuster for all their help and contributions. I would also like to thank
those who have provided feedback and bug reports.
thanks,
AW
The agenda for the 2008 DoD Cyber Crime Conference has been posted:
http://www.technologyforums.com/8CC/trackagenda.asp
I'll be giving a talk during the Research and Development Track at 0830
January 16, 2008. In this talk I will be discussing the latest
advancements in the area of Volatile Memory Analysis and how they affect
the way we perform digital investigations.
Title:
Advanced Volatile Memory Analysis
Abstract:
This session will focus on advanced techniques being used in
volatile memory analysis (VMA) and our experiences while performing VMA.
We will also discuss a number of open source tools and resources we have
made available to the digital investigation community. The session will
also explore how we are using VMA to perform automated malware analysis.
Finally, we will demonstrate how we are combining VMA with file system
analysis to help reconstruct and visualize the digital crime scene.
AW
These scripts were recently sent to me by a Volatility user, the methUd,
and I thought others might find them useful. These scripts will allow you
to run all the Volatility modules against a single image or against a
directory of images. Enjoy!!
AW
