What are the most effective techniques for performing live memory forensics on encrypted systems?

All answers to this question.

Live memory forensics is a delicate art. First, you should use a trusted tool like DumpIt or Magnet RAM Capture. Always run these from a write-protected USB drive to minimize the footprint on the target system. Once you have the memory dump, you can use Volatility or Rekall to search for the BitLocker recovery keys within the RAM. This allows you to decrypt the physical disk image later without needing the user's' password. The key is to be as "quiet" as possible; avoid opening large applications or browsing the file system while the capture tool is running, as this can overwrite the very data you are trying to save.

   Answered 2024-08-14 by Kimberly Thompson

Have you checked the system for "Anti-Forensic" measures? Some modern malware variants will detect the execution of a memory dumper and immediately wipe the RAM or trigger a system reboot to clear their tracks.

   Answered 2024-08-18 by Christopher Evans

• Christopher, we did encounter a "wiper" once. Now, we use a hardware-based DMA (Direct Memory Access) attack tool like PCILeech when we suspect the malware is forensic-aware. It allows us to read the memory over the hardware bus without the operating system—or the malware—ever knowing that the memory is being accessed. It's more complex to set up but much safer for sensitive investigations.

     Commented 2024-08-21 by Daniel Harris

Always remember to capture the pagefile and hiberfil.sys as well. Sometimes the encryption keys or fragments of the malware are swapped out from the RAM to the disk.

   Answered 2024-08-24 by Sarah Jenkins

• Great point, Sarah. I’ve found crucial artifacts in the hibernation file that were no longer present in the active RAM dump because the system had been running for so long.

     Commented 2024-08-26 by Marcus Reed