In my previous post, I described how to collect a memory dump from a Linux system. In this post, I will describe how to use the Volatility framework to analyze that memory dump. To do so requires that we first create a profile for the system from which the memory dump was taken.
Showing posts with label memory. Show all posts
Showing posts with label memory. Show all posts
Wednesday, December 18, 2013
Linux Memory Forensics
Today I am taking a look at two of the more popular tools for performing memory acquisition from Linux systems. A quick search lands us at ForensicWiki which lists five tools for performing memory dumps on Linux systems. Two of the more useful freeware tools are fmem and LiME. This post details my experience using both tools.
Subscribe to:
Posts (Atom)