Capturing Windows Memory
It has been a while since my last post. Changing jobs pointed me in a different direction for a while but as George and Frank Constanza would say. "I'm back baby!"
I recently had to look into windows memory capture to do some offline analysis of running processes.
My normal 'goto' tool for taking a forensic image and memory capture is usually FTK Imager. It is pretty robust and ninja proof.
You can copy the install directory to an external USB and it will run nicely as a portable version. When we run this it obviously loads into memory which be present when we capture the system memory.
I started to think of if there were any other tools that could do memory analysis and compare some of there features such as
- Memory Footprint - smaller and less processes is better
- Portable - I don't really want to install it on the system in question
- Fast - Memory capture is often the first stage of a Incident Response so I it to be fast
- Access privilege required - do I need to be admin or can I run this a least privilege user.
- Stand alone - Do I need to buy the whole forensic suite or can I just get the memory capture tool
- Price - gratis is good but a low cost good tool is OK too.
- Easy of use - I don't want to fumble in the field with pesky undocumented command line switches.
While there has been numerous blogs on some of the available tools I was mainly interested on the footprint and speed. If the tool was loaded into memory the risk is that some of the data of interest may be popped out.
After some quick browsing it seems the current options are (in no order of preference):
- FTK Imager
- Magnet RAM
- Process Hacker
- Mandiant Memoryze