Exploring Host-Based Digital Forensics with Memory Analysis

Host-based digital forensics is just one aspect of investigating cyber security incidents with a lens on the investigation and analysis of individual computers and devices. This is in contrast to Network forensics which is focused on network logs and packet captures. This blog post will look at key concepts and tools from a 30,000 foot level.

What is Host-Based Digital Forensics?

Host-based digital forensics involves analysing data from individual computers, laptops, and mobile devices to uncover evidence related to cyber incidents. This can include examining file systems, memory, and system logs to identify malicious activity, recover deleted files, and understand how an attacker gained access.

If you’re interested in Digital Forensics, check out my podcast : TLP – Traffic Light Protocol The Digital Forensics Podcast. https://open.spotify.com/episode/6ZyAyPBqTQMmwWdO7wTGHc?si=b0f5775d3f42418b

An artefact that is often overlooked is memory. Around 2003 @thegrugq coined the term ‘the data condom’. What he was referring to here is fileless malware that attempts to run in memory only and not on disk.

Many malicious activities leave little to no trace on disk but do leave artifacts in memory. Memory analysis can reveal:

Running Processes: See all the programs and scripts running, including hidden or malicious ones (this is great if you don’t have sysmon or sysmon process tracking enabled (but you should))
Network Connections: Check for suspicious connections to the internet or other devices (the same effect can be achieved by running netstat -nao from cmd (don’t forget to track the time you typed the command and opened cmd.exe in your contemporaneous notes though, as this can look like attacker tradecraft)
Loaded Modules: Identify loaded DLLs and other modules that could be part of an attack. Module analysis is going a bit deeper into the rabbithole of memory forensics. Once you start analysing individual modules you can detect more malware and malicious activity. This is a good step to look at things like process hollowing and code injection.

These attacks are where an exploit is used to overwrite memory for a legitimate process. On the surface, it looks like a legitimate process but the code inside is actually malicious (process hollowing)

Real-World Example: Investigating a Malware Infection

Imagine a scenario where a company’s employee reports unusual behavior on their computer. The incident response team suspects malware and begins a host-based forensic investigation. Using tools like FTK Imager (to capture ram) and volatility to analyse memory, they analyze the computer’s file system and memory. They discover a malicious executable file hidden in a seemingly innocuous folder. Further analysis reveals that the malware was designed to steal sensitive data and send it to an external server.

Step-by-Step Investigation Process:

Data Acquisition: The first step is to create a memory forensic image of the compromised host. As always, save the memory dump to an external harddrive.

To capture the memdump use FTK Imager. Just click on File->Capture Memory

Analysis: To investigate the memdump, use volatility. Some of my favourite commands in volatility are:

vol.py -f base-rd01-memory.img kdbgscan > kdbgscan.txt

This isn’t a favourite, it’s a necessity! The output from this command gives me a profile (which is on the next line). Specifying the profile is essential for some volatility commands so Volatility knows where to look and how the memory space is addressed.

Dump specific process from RAM image

If you want to see what else FTK Imager can do, take a look at my blog post on FTK Imager here where I explain how to create a custom content image: https://dfirinsights.com/2018/02/15/ftk-imager-creating-custom-content-images-with-classic-file-types/

1. ↩︎