3:30 p.m.
I know that Jon Evans at Gwent Police in the UK has demonstrated this
method. I'll be amazed if Jon doesn't subscribe to this list and so may be
able to give some more info.
More info can be found here:
http://forums.remote-exploit.org/archive/index.php/t-13922.html
The method utilises Adam Boileau's Winlockpwn tool. Adam's Pythonraw tool
is available on Helix. http://www.e-fense.com/helix/downloads.php
If I recall one "slight" issue with this method is the tendency to BSOD. To
quote Keith Lockhart at Access Data "This is a Bad thing!"
Jim
On 8/7/08 18:00, "vol-users-request(a)volatilityfoundation.org"
<vol-users-request(a)volatilityfoundation.org> wrote:
Send Vol-users mailing list submissions to
vol-users(a)volatilityfoundation.org
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
or, via email, send a message with subject or body 'help' to
vol-users-request(a)volatilityfoundation.org
You can reach the person managing the list at
vol-users-owner(a)volatilityfoundation.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Vol-users digest..."
Today's Topics:
1. RE: Memory imaging (Jamie Levy)
----------------------------------------------------------------------
Message: 1
Date: Mon, 7 Jul 2008 14:57:33 -0400
From: "Jamie Levy" <jamie.levy(a)gmail.com>
Subject: RE: [Vol-users] Memory imaging
To: vol-users(a)volatilityfoundation.org
Message-ID:
<cac8c8a90807071157w7b6e388ej660382ede0116884(a)mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Hi evb,
I'm not sure, but maybe this will help (maybe someone else on here
knows better than I do):
http://computer.forensikblog.de/en/2008/02/acquisition_5_firewire.html
I've never tried memory acquisition using firewire, but it sounds like
it might be worth a try.
All the best,
-Jamie
------------------------------
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
End of Vol-users Digest, Vol 10, Issue 4
****************************************
4:28 p.m.
evb,
There a number of potential techniques that are being used to deal with
locked machines. Though I must give my usual caveats that I would make
sure you know what you are doing and actually have experience with the
acquisition method before trying it as part of a real investigation.
Some of the techniques are hardware dependent, have the potential to BSOD
the machine, or are potentially destructive, so you may only get one
attempt. In some instances, it may be useful to get outside help.
As Jim and Jamie mentioned, performing acquisition via firewire is a
potential option. Details about this technique can be found on the follow
site: http://storm.net.nz/projects/16. They even mention using a CardBus
firwire card. Others have successfully used techniques similar to those
presented in the Cold Boot paper (http://citp.princeton.edu/memory/) or
similarly, msramdmp: (http://mcgrewsecurity.com/projects/msramdmp/)
Depending on how the laptop is configured, the hibernation file is another
alternative. There are also other hardware solutions but they are very
expensive.
Regards,
AW
On Tue, 8 Jul 2008, Jim Gordon wrote:
I know that Jon Evans at Gwent Police in the UK has demonstrated this
method. I'll be amazed if Jon doesn't subscribe to this list and so may be
able to give some more info.
More info can be found here:
http://forums.remote-exploit.org/archive/index.php/t-13922.html
The method utilises Adam Boileau's Winlockpwn tool. Adam's Pythonraw tool
is available on Helix. http://www.e-fense.com/helix/downloads.php
If I recall one "slight" issue with this method is the tendency to BSOD. To
quote Keith Lockhart at Access Data "This is a Bad thing!"
Jim
On 8/7/08 18:00, "vol-users-request(a)volatilityfoundation.org"
<vol-users-request(a)volatilityfoundation.org> wrote:
Send Vol-users mailing list submissions to
vol-users(a)volatilityfoundation.org
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
or, via email, send a message with subject or body 'help' to
vol-users-request(a)volatilityfoundation.org
You can reach the person managing the list at
vol-users-owner(a)volatilityfoundation.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Vol-users digest..."
Today's Topics:
1. RE: Memory imaging (Jamie Levy)
----------------------------------------------------------------------
Message: 1
Date: Mon, 7 Jul 2008 14:57:33 -0400
From: "Jamie Levy" <jamie.levy(a)gmail.com>
Subject: RE: [Vol-users] Memory imaging
To: vol-users(a)volatilityfoundation.org
Message-ID:
<cac8c8a90807071157w7b6e388ej660382ede0116884(a)mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Hi evb,
I'm not sure, but maybe this will help (maybe someone else on here
knows better than I do):
http://computer.forensikblog.de/en/2008/02/acquisition_5_firewire.html
I've never tried memory acquisition using firewire, but it sounds like
it might be worth a try.
All the best,
-Jamie
------------------------------
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
End of Vol-users Digest, Vol 10, Issue 4
****************************************
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
5:04 p.m.
Aaron,
Unfortunately there is a big question mark over the evidentiary value of
memory evidence acquired using firewire, which Boileau himself acknowledges
on his web site. No one has bothered to do the basic research needed to
establish when and if firewire memory dumps are reliable. In at least one
case they clearly were unreliable. Presumably evb wants to acquire the
memory with a view towards taking some administrative action against the
employee. This action might itself have legal repercussions, especially if
the firewire memory dump is not admitted to justify the actions taken.
The heart of forensics is the relationship between the evidence and law.
When discussing the technical aspects of acquiring volatile evidence we need
also to keep in mind the evidentiary issues which may (almost certainly
will) arise should the "evidence" ever be put to use.
Regards,
RossetoeCioccolato.
6:08 p.m.
George,
You raise some very good points! I firmly believe that more research needs
to be done in analyzing all the mechanism being used for memory
acquisition, not just firewire. This is the reason that we have started
the Memory Forensics Tool Testing (MFTT) initiative. It is our hope that
you will be willing to combine your experiences with ours to make this a
valuable contribution to the community. On that note, did you ever do more
research into the issue discussed on Boileau's website or would you care
to provide more details about the discrepancies and the testing methods
used?
As we have discussed previously, I think the question of evidentiary value
is a little more complicated. How would you recommend that evb acquire a
sample of memory given his situation? Based on the possibility of the
aforementioned discrepancies, is it better that he not collect a sample of
memory? Do you think that this administrative action would be based solely
on an artifact extracted from the memory sample? I typically try to
acquire as many artifacts as possible using the "best" mechanisms
available. While being cognizant of the evidential issues and appreciating
their importance, I typically try to focus on the technical aspects since
I'm not a lawyer. That is why I pay them the big bucks!
Thanks again for your insightful email and we are greatful for your
contributions to the list.
AW
On Tue, 8 Jul 2008, George M. Garner Jr. wrote:
Aaron,
Unfortunately there is a big question mark over the evidentiary value of
memory evidence acquired using firewire, which Boileau himself acknowledges
on his web site. No one has bothered to do the basic research needed to
establish when and if firewire memory dumps are reliable. In at least one
case they clearly were unreliable. Presumably evb wants to acquire the
memory with a view towards taking some administrative action against the
employee. This action might itself have legal repercussions, especially if
the firewire memory dump is not admitted to justify the actions taken.
The heart of forensics is the relationship between the evidence and law.
When discussing the technical aspects of acquiring volatile evidence we need
also to keep in mind the evidentiary issues which may (almost certainly
will) arise should the "evidence" ever be put to use.
Regards,
RossetoeCioccolato.
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
9:25 p.m.
: In at least one
:case they clearly were unreliable.
Rossetoecioccolato and All,
Thank you so much for the responses. I am about to research these ideas.
Rossetoecioccolato, do you perhaps have a legal citation for the case you
reference? I would like to see how a judge reached her conclusion.
eric
10:23 p.m.
evb,
I am sorry for the confusion but I wasn't referring to a court case. Rather
I was referring to a single firewire memory "image" that was sent to me for
analysis. I was able to determine from some kernel variables that the
operating system on the "suspect" computer would not have been able to run
if the "image" was accurate. We simply don't know the reason why the
firewire memory "image" was corrupt. Was it a bug in Boileau's python code,
or a bug in the Linux firewire driver, or a bug in that particular firewire
chipset? I haven't had time to research the acquisition method further. To
my knowledge no one has bothered to follow up with the sort of basic
research that would establish the parameters under which this acquisition
method may be used reliably.
Your problem is that the only published report is that firewire memory
acquisition is unreliable, which may place you in a difficult position
should you choose to rely on it.
If the "prohibited pictures" are CP then you should turn the case over to
your local law enforcement who may have capabilities that are not available
to you.
Sorry that I cannot be of more help.
Regards,
Rossetoecioccolato.
6134
days inactive
6135
days old
vol-users@lists.volatilityfoundation.org
5 comments
4 participants
participants (4)
-
AAron Walters -
evb -
George M. Garner Jr. -
Jim Gordon