Volatility

Last Call: Open Memory Forensics Workshop 2014

Wed, 22 Oct 2014 17:59:30 -0400

As previously mentioned, the registration for the Open Memory Forensics Workshop (OMFW) 2014 closes on Oct 24. If you are interested in attending, there are a few seat remaining. Examples of the exciting talks include:

Science, Sharing, and Repeatability in Memory Forensics - Brendan Dolan-Gavitt
Memory Forensics for IR: Leveraging Volatility to Hunt Advanced Actors - Jared Greenhill
Memory Tracing: Forensic Reverse Engineering - Endre Bangerter
Restructuring memory: Extracting results in a reusable way - Mike Auty
Next Generation TCP/IP Stack Deep Dive - Joe Sylve
Careto: Accomplishing in 7 minutes what AV couldn’t do in 7 years - Andrew Case

Reserve your seat by sending an email to info [at] volatilityfoundation.org or using the contact form on the Foundation’s website.

Reminder: OMFW 2014 Registration Closes Oct 24

Fri, 17 Oct 2014 10:37:44 -0400

Reminder: OMFW 2014 Registration Closes Oct 24:

The registration for the Open Memory Forensics Workshop (OMFW) 2014 closes on Oct 24. If you are still planning to attend, I recommend sending a request as soon as possible. There are less than 10 open seats remaining! For those who have already requested an invitation, please let us know if you have not received your registration details.

Reserve your seat by sending an email to info [at] volatilityfoundation.org or using the contact form on the Foundation’s website.

The Volatility Foundation: Fighting for Open Source Forensics

Tue, 30 Sep 2014 16:21:09 -0400

We are excited to announce that the Volatility Foundation was officially granted 501©(3) status by the IRS and the application was approved in less than a year. This comes as great news when you consider the recent “BOLO” list controversies and the Yorba situation. We believe this is an encouraging sign for the future of free and open source software.

As an added benefit of the Volatility Foundation’s new status, supporters can now make tax-exempt donations to the foundation! Based on your generosity and the hard work of our developers, Volatility will continue to develop innovative software and fight against those who exploit open source forensics developers!

Shouts to Patrick and the Volatility legal team! We would also like to thank the IRS for their swift response.

OMFW 2014 Update & Dr. Brendan Dolan-Gavitt

Thu, 11 Sep 2014 10:15:13 -0400

We are excited to announce that over half the seats for the Open Memory Forensics Workshop (OMFW) 2014 have already been reserved. It’s also great to see a large number of first time attendees from across government, academic, and commercial institutions. This is your one chance a year to hear about the latest research in memory forensics from the people who are pioneering the field. If you are still planning to attend, we suggest you register as soon as possible to make sure you have a seat.

We are also excited to announce that Dr. Brendan Dolan Gavitt (moyix) will be speaking at the workshop. As many of you know, Brendan has been a member of the Volatility family since the very beginning and recently earned his PhD from the Georgia Institute of Technology. If you have followed Brendan’s work throughout the years and his new research with PANDA, I’m sure you will not be disappointed.

In the upcoming weeks, we will continue finalizing and announcing the exciting roster of speakers.

Facebook Doubles Volatility Contest Prizes

Thu, 04 Sep 2014 08:06:01 -0400

As mentioned earlier this week, we have extended the deadline for the 2014 Volatility Plugin Contest until October 1st because an organization wanted to augment the prizes. We are excited to share that due to an extremely generous donation from Facebook, the total cash prizes have been doubled from $2250 USD to $4500 USD!

If you have already submitted to the contest, you can use this extra time to fine tune your submission or submit another entry to improve your chances. If you were considering submitting, you now have an extra month to demonstrate your creativity, become a memory analysis pioneer, win the admiration of your peers, and give back to the community!

It’s great to see some of the largest companies in the world showing their support for and giving back to the memory forensics community! Thank you, Facebook, and good luck to all participants in the contest - the stakes have literally just doubled!

2014 Volatility Plugin Contest Deadline Extended

Mon, 01 Sep 2014 16:13:52 -0400

Despite the fact we have already surpassed the number of submissions to last year’s contest, we are excited to announce that we have extended the
deadline for the 2014 Volatility Plugin Contest until October 1st, 2014. We
received a number of inquiries from people who recently learned about the
competition when they purchased “The Art of Memory Forensics” and an
exciting new competition sponsor (more details next week) that wanted to
further augment our prizes.

If you have already submitted to the contest, you can use this extra time to
fine-tune your submission. If you were considering submitting, you now have an extra month to demonstrate your creativity and implement an innovative, interesting, and useful Volatility extension! It’s great to see some of the largest companies in the world showing their support for and giving back to the memory forensics community!

Presenting Volatility Foundation Volatility Framework 2.4

Thu, 14 Aug 2014 01:51:19 -0400

Registration for OMFW 2014 is officially open! Be sure to register early as seats are limited.

The release of this new Volatility version coincides with the publication of The Art of Memory Forensics. It adds support for Windows 8, 8.1, 2012, and 2012 R2 memory dumps, Mac OS X Mavericks (up to 10.9.4), and Linux kernels up to 3.16. New plugins include the ability to extract cached Truecrypt passphrases and master keys from Windows and Linux memory dumps, investigate Mac user activity (such as pulling their contact database, calendar items, PGP encrypted mails, OTR Adium chat messages, etc), and analyze advanced Linux rootkits. See below for a detailed change log.

Binary releases, including pre-built executables for Windows and Mac OS X can be found on the Volatility Foundation website: http://www.volatilityfoundation.org. We’ve also now moved our source code repository to Github: https://github.com/volatilityfoundation. Note that there’s a separate repository containing over 160 Linux profiles for 32- and 64-bit OpenSuSE, Redhat, Debain, Ubuntu, Fedora, and CentOS (thanks Kevin!); and all Mac OS X profiles from 10.5 to 10.9.4.

The detailed change log is below:

Windows Memory Forensics

Truecrypt plugins (summary, cached passphrases, master keys)
Apihooks support for 64-bit memory images
Apihooks plugin detects JMP FAR hook instructions
Hashdump, Cachedump, and Lsadump plugins updated for x64 and Win8/2012
Callbacks and timers plugins work on 64-bit memory images
Mftparser identifies NTFS alternate data streams
Mftparser -D option extracts MFT-resident files to disk
Ability to scan for multiple executive object types concurrently with a single pass through the memory dump
Procmemdump and procexedump condensed into “procdump” (and –memory option available)
Envars plugin has a –silent flag to ignore common/default environment variables
Vadtree plugin in graphviz output mode (–output=dot) color codes nodes per heap, stack, mapped file, DLL, etc.
Getsids plugin automatically resolves user and service SIDs
Timeliner plugin supports –machine to identify the source in multi-source timelines
Verinfo (PE version info) plugin updated and moved into core framework
Strings translator prints “FREE MEMORY” for data found in deallocated regions (used to skip them)
Vadinfo plugin allows –addr to specify one region rather than printing them all
Yarascan plugin allows you to control –size (bytes in preview) and –reverse (show data *before* a hit)
Volshell plugin has new APIs proc(), addrspace(), getprocs(), and getmods() for easy access
All process based plugins accept –name (process name regular expression filter)
Added the auditpol plugin to check audit policies
Added the cmdline plugin to show process command line arguments
Volshell plugin can recursively print structure members (similar to windbg’s dt /r)
New pooltracker plugin allows analysis of kernel pool tag statistics
New bigpools plugin allows finding big page pool allocations
Svcscan plugin prints service start type (manual, automatic, disabled, etc)
Added a plugin to find and print text on the Notepad application’s heap
PE dumping plugins (procdump, dlldump, moddump) support –fix to fix the image base value
Joblinks plugin for getting information for job objects

Address Spaces / File Formats

Support for QEMU virtual machine memory images
Support for “split” VMware files (memory in .vmem and metadata in .vmss/.vmsn)
Support for Windows BitMap crash dumps (created by Windows 8 / 2012 on BSOD)

Mac Memory Forensics

Support for Mavericks through 10.9.4
Mac string translation added
Recover sent and received Adium messages, including those protected by OTR
Enumerate contacts from the Contact application’s database
Extract the HTML content of notes from the Notes application
Ability to reveal clear-text PGP emails sent or received with the Mail application
Locate Apple Keychain encryption keys in memory (for cracking with Chainbreaker)
Find API hooks in both the kernel and process memory
List IP and socket filters
Extract loaded kernel extension to disk
Find suspicious process mappings (i.e. injected code)
Find hidden kernel extensions
Recovered files cached in memory

Linux Memory Forensics

Support for Linux kernels through 3.16
Linux string translation added
Detect API hooks in both userland processes and the kernel
Detect GOT/PLT overwrites
Find hollowed executables
Find suspicious process mappings
Library listing using the loader’s data structures
Extract process ELF executables and libraries to disk
List network interfaces in promiscuous mode
List processes that are using raw sockets
Find hidden kernel modules
List Netfilter hooks
Extract cached Truecrypt passphrases

Celebrate with the Volatility Team!

Thu, 10 Jul 2014 08:20:57 -0400

It’s been an exciting year for the Volatility team (@volatility) and we want you to come celebrate with us! The Volatility team will have a strong presence at both Black Hat USA and DFRWS 2014. This includes presentations, a book signing, and even a party!

At Black Hat, the core Volatility Developers (@4tphi, @attrc, @gleeda, @iMHLv2, and Mike Auty) will be partaking in a number of events including:

Releasing Volatility 2.4 at Black Hat Arsenal: This release includes full support for Windows 8, 8.1, Server 2012, and Server 2012 R2, TrueCrypt key and password recovery modules, a switch to GitHub hosting, as well as over 30 new Mac and Linux plugins for investigating malicious code, rootkits, and user activity.
Releasing The Art of Memory Forensics: AMF is over 900 pages of memory forensics and malware analysis across Windows, Mac, and Linux. It will be available for the first time in the bookstore during the pre-conference trainings and briefings.
Book Signing for AMF: On Wednesday, August 6th at 3:15PM, in the Black Hat book store, we will be on site for signing books.
Volatility Happy Hour sponsored by The Hacker Academy: This will be an open bar party where you can meet our team, bring books to be signed, and get stickers, t-shirts, and other Volatility swag all while enjoying tasty beverages. You must register (free) if you wish to attend!

At DFRWS, Dr. Golden Richard (@nolaforensix), one of the Technical Editors for AMF, will be presenting a paper that he and @attrc wrote: In Lieu of Swap: Analyzing Compressed RAM in Mac OS X and Linux. In this paper, they discuss the in-memory, compressed swap facilities of Mac OS X and Linux, their impact on memory forensics investigations, and how they developed Volatility plugins to decompress the caches transparently during the operation of Mac & Linux analysis plugins.

We hope to see everyone at these events, and we are looking forward to an exciting August! As a quick reminder, the 2014 Volatility Plugin Contest ends September 1. This is your opportunity to contribute to the Volatility community and win cash! We are also in the process of finalizing details on OMFW 2014. If you have something interesting to present, please reach out!

Volatility Skills in High Demand!

Thu, 26 Dec 2013 16:43:21 -0500

Volatility Skills in High Demand!:

We frequently get inquiries from companies looking to recruit people with Volatility skills. As an example, check out this required skill from a recent Salesforce.com job description:

Required Skills:

“You didn’t write Volatility (or maybe you did!), but you could write a book on how to use it.”

The best way to obtain these required skills is spending time with the developers who pioneered the field of memory analysis. Check out the only Volatility training endorsed by the Volatility Foundation and taught by Volatility developers!

Volatility Featured in Linux Magazine (Issue #157 / Dec 2013)

Thu, 26 Dec 2013 15:13:32 -0500

Volatility Featured in Linux Magazine (Issue #157 / Dec 2013):

The December 2013 issue of Linux Magazine features an article about Volatility.

“The Volatility forensic tool helps admins analyze what went wrong on a system. When you need to draw conclusions about malware, or even compromised services, peer into memory with Volatility.”

Facebook Uses Volatility to Support Their Production Forensics Infrastructure

Thu, 26 Dec 2013 14:58:09 -0500

Facebook Uses Volatility to Support Their Production Forensics Infrastructure:

In this post, Facebook is sharing some experiences about building a forensics infrastructure for their production environment.

“The configuration uses an internal repository that contains useful open source tools such as Sleuthkit, LiME, Volatility, bulk_extractor and more. This level of automation helps us achieve our ‘timely’ requirement by immediately enabling an incident responder to perform collection, timelining, and memory/disk analysis.”

OMFW 2013: Bringing Mac Memory Forensics to the Mainstream - Andrew Case (@attrc)

Tue, 22 Oct 2013 22:46:05 -0400

“Bringing Mac Memory Forensics to the Mainstream”, Andrew Case (@attrc), OMFW 2013.

Volatility now includes full Mac support for all versions from 10.5.x through the latest 10.8.x, both 32 and 64 bit. This presentation will show how these capabilities can be used in a variety of scenarios including digital forensics, incident response, and malware analysis. The presentation will also highlight many of the challenges that had to be overcome in pursuit of comprehensive Mac memory analysis support. Many of these challenges are unique to Mac, and required deep understanding of the often “interesting” design decisions made by the operating system developers.

OMFW 2013: Every Step You Take: Profiling the System - Jamie Levy (Gleeda)

Mon, 21 Oct 2013 21:11:07 -0400

“Every Step You Take: Profiling the System”, Jamie Levy (@gleeda), OMFW 2013.

As DFIR investigations become more complicated, often spanning several machines, there is a need to employ some mechanisms in the memory forensics realm which are already heavily used in disk forensics. Some of these mechanisms include: whitelisting/blacklisting, indicators of compromise (IOCs) and profiling. This talk will cover new plugins that enable the investigator to create, combine and modify baseline profiles, to easily see items on either side of a baseline profile and hunt for IOCs across the enterprise

OMFW 2013: Mastering TrueCrypt and Windows 8 / Server 2012 Memory Forensics - Michael Hale Ligh (MHL)

Fri, 18 Oct 2013 16:52:00 -0400

“Mastering TrueCrypt and Windows 8 / Server 2012 Memory Forensics”, Michael Hale Ligh (@iMHLv2), OMFW 2013.

This talk provides a how-to on leveraging memory forensics to investigate and defeat TrueCrypt hard disk encryption. We’ll walk through scenarios involving different suspects who used file-based containers, non-system partitions (i.e. flash drives), and full drive encryption to hide their assets. During the demonstrations, you’ll learn about three new Volatility plugins for recovering cached TrueCrypt passphrases, identifying the exact paths to the file-based containers, and extracting master keys even when suspects stray from AES and use non-default algorithms like Serpent and Twofish. As a subtle facet, we’ll be doing all of this on 32- and 64-bit Windows 8 and Server 2012 memory dumps - the first major new Windows operating system supported by Volatility in nearly two years.

This presentation is particularly topical considering the recent discussions about TrueCrypt.

OMFW 2013: Stabilizing Volatility - Mike Auty (Ikelos)

Wed, 16 Oct 2013 10:31:00 -0400

Stabilizing Volatility. Mike Auty (ikelos), OMFW 2013

This talk will step through a very brief history of Volatility, then cover the structure of the core, before explaining the primary techniques currently used in the Object, Address Space and Profile classes, as well as touching on some helper objects. The middle will cover several design decisions later found to be poor, and whether/when those can be resolved. Finally, an outline of new structures designed to overcome several of the limitations in the current Volatility will be shown.

OMFW 2013: All Your Social Media are belong to Volatility - Jeff Bryner

Tue, 15 Oct 2013 21:13:28 -0400

All Your Social Media are belong to Volatility, Jeff Bryner (@0x7eff), Incident Response/Forensics at Mozilla, OMFW 2013

Volatility is by far the richest memory forensic toolkit available. This year they upped the ante by inviting regular mortals to write plug-ins and submit them for the greater good. This session will demo my submissions for forensic recovery of social media artifacts from Facebook and Twitter. We will have the audience participate live by engaging with a Twitter and Facebook account, dump the memory of the victim machine and see what we can recover via Volatility. If time allows we will have a look at the code with an eye on encouraging more plugins for other social media sites; Tumblr, Pinterest, Flickr, Youtube, etc await!

OMFW 2013: Memoirs of a Hindsight Hero: Detecting Rootkits in OS X - Cem Gurkok

Mon, 14 Oct 2013 13:12:00 -0400

Memoirs of a Hindsight Hero: Detecting Rootkits in OS X, Cem Gurkok, OMFW 2013.

The OS X Kernel has become a popular target for malicious adversaries. At the moment there are tools that provide detection for basic OS X rootkit techniques, such as executable substitution or direct function modification (e.g. the Rubilyn rootkit). Advanced rootkits often leverage more advanced capabilities that are harder to detect, such as function inlining, DTrace hooks, call reference modification, shadow syscall and trustedbsd policy tables. In this presentation, I will be exploring how to attack the OS X syscall table and other kernel objects with these advanced techniques and how to detect these modifications in memory using the Volatility Framework. The presentation will include demonstrations of system manipulation on a live system and subsequent detection using the new Volatility Framework plugin.

OMFW 2013: Dalvik Memory Analysis and a Call to ARMs - Joe Syle

Fri, 11 Oct 2013 11:18:21 -0400

We wanted to highlight a few of the talks that will be presented at OMFW 2013:

Dalvik Memory Analysis and a Call to ARMs. Joe Sylve (@jtsylve) Managing Partner, 504ENSICS Labs

This talk will detail our DARPA Cyber Fast Track research effort for parsing Dalvik-level constructs from memory captures of Android devices. These include (at least) all of the built-in types, class names, statics, methods and variables, and similar information with values for object instances. In our effort we also have created, a free GUI-based browser, called Dalvik Inspector, with browsing, searching, and automated Volatility plugin generation capabilities for analysis of the raw parsed data. This tool facilitates deep, standalone analysis of application-internal structure. This talk will conclude with a discussion and appeal to the research community in regards to open research problems that need to be addressed in order to make Android memory analysis viable for the community at large.

Volatility Labs: Memory Forensics Training - Reston, VA - November 2013

Tue, 08 Oct 2013 17:26:38 -0400

Volatility Labs: Memory Forensics Training - Reston, VA - November 2013:

This event will be the 5th public offering of the Windows Malware and Memory Forensics Training by The Volatility Project. This is the only memory forensics course officially designed, sponsored, and taught by the Volatility developers. One of the main reasons we made Volatility open-source is to encourage and facilitate a deeper understanding of how memory analysis works, where the evidence originates, and how to interpret the data collected by the framework’s extensive set of plugins. Now you can learn about these benefits first hand from the developers of the most powerful, flexible, and innovative memory forensics tool.

While the training course is constantly being updated, there are two updates being introduced during the Reston training that are worth highlighting:

Windows 8 & Server 2012 Support
Mastering TrueCrypt

Dates: Monday, November 11th through Friday, November 15th 2013
Location: Reston, VA (exact location will be shared upon registration)
Instructors: Michael Ligh (@iMHLv2), Andrew Case (@attrc), Jamie Levy (@gleeda)

OMFW Registration Update

Fri, 13 Sep 2013 15:49:37 -0400

OMFW Registration Update:

The official registration invitations for OMFW 2013 went out earlier this week. If you are still planning to attend, I recommend sending a request as soon as possible. As of this afternoon, there are only 5 spots remaining! Starting next week, we will begin finalizing and announcing the exciting roster of speakers.

https://www.volatilesystems.com/default/omfw

Reserve your seat by contacting: info [at] volatilesystems [dot] com.