Analyzing Windows Memory Essay

1339 words - 5 pages

Network investigation cases will rarely follow a rote path. However, most investigations have a few typical steps that are taken. One of the first steps is to acquire the memory if we are doing a live analysis. We can glean a myriad of invaluable information from a computer’s memory. This information may include hidden and running processes, when these processes were started and by whom, and what these specific processes were doing. Terminated objects may even be found in memory days after they were killed. The memory also will have the state of active network connections (Burdach).
“Windows memory analysis techniques depend on the examiner’s ability to translate the virtual addresses used by programs and operating system components into the true locations of data in a memory image,” (Schuster). Due to Windows caching large amounts of file data in memory we need to ensure we take invalid, mapped-file data into account. Memory is divided into 4096 bytes of data that is referred to as a page when in memory and a frame when on the hard drive. The memory manager assigns pages to a process to utilize as data storage for that process. When a page does not meet this criterion is said to be invalid (Burdach). In some memory images over 20% of the virtual addresses we find point to “invalid” pages that cannot be found using an average method for address translation (Schuster). By using every available page we can greatly increase the totality of the analysis and accurately recreate the machine as it existed at the time of imaging.
Data Carving can be done with memory just as with the hard disk. Data carving algorithms cannot recover fragments if a page is not yet loaded into memory, though. We can, however, reconstruct these fragments by interpreting file-mapping related structures (Shuster). File mappings are administered by data structures; which are allocated from memory pools. “A memory pool is a dynamic memory area allocated by the kernel where it stores administrative structures,” (Schuster). There are four byte numbers, pool tags, stored in the headers of the structures that will determine the type of pool structure (i.e. Proc, VAD, and Obtb). The memory pool structure is identified by its pool tag Eprocess Structure (Proc). The Proc contains pointers to the Object Table (Obtb) and the Virtual Address Descriptor (VAD) root (Dolan-Gavitt). The Obtb lists the private objects that are in use by the process. These objects include File objects (pool tag FILE), registry key objects (pool tag Key), and event objects (pool tag Evt) (Dolan Gavitt). The VAD root is the starting point of the VAD tree, and the VAD tree contains the memory ranges that are in use by a process (Dolan-Gavitt). Therefore we can reconstruct a process’ virtual address space utilizing the VAD tree.
The VAD tree has various pool tags that correlate to various types of Virtual Address Descriptors. Two of these common pool tags, Vad and VadL contain...

Find Another Essay On Analyzing Windows Memory

Novell Network for Company Security Essay

4530 words - 18 pages . You can kill a process that is not replying with kill command. Linux has true multitasking property. It is true because it is not like Windows. You can run up to twelve processes in the same time with no performance loss. Microsoft claims that Windows has the capability of multitasking but you cannot run two processes on the same time. Linux has virtual memory. It means that you can use your hard disk as memory. You make a swap partition on

Turing Notes Essay

2380 words - 10 pages , PowerPoint, games, etc.Systems Software - helps the computer to manage its own resourcesExample: Windows, Mac OS, LinuxProgramming Editors/Environments - allow users to create their own application or systems softwareExample: Turing, JavaFocus on Software:5 Operating Systems:UNIXLinuxMicrosoft WindowsDOSMac OSTwo tasks which the operating systems performAccepting input from the keyboardManaging input and output between the computer and external

System analysis

1202 words - 5 pages the company is Company XX's main focus. It will be used to monitor power usage and temperature of the data floor.System AnalysisSystem analysis is "the process of analyzing a system were two tasks must be performed: Modelling the system and solving for the model's response" (Julia Maslov, n.d.). The system analysis process usually begins with a request of a product or process to be analyzed and at the end of the analysis a fully functional product

System Analysis

1197 words - 5 pages monitor power usage and temperature of the data floor.System AnalysisSystem analysis is "the process of analyzing a system were two tasks must be performed: Modelling the system and solving for the model's response" (Julia Maslov, n.d.). The system analysis process usually begins with a request of a product or process to be analyzed and at the end of the analysis a fully functional product or process should be able to be implemented. Within the

Mobile Phone Firmware Flashing for Nokia.

9287 words - 37 pages INTRODUCTION1.1 OverviewFirmware can be found on any electronic devices such as mobile phone, computer hardware and measurement instrumentation. Basically the downloading codes to the Read Only Memory (ROM) are called flashing. The size of the ROM really depends on the complexity of the hardware and the microcode itself. Thus, the firmware incorporates the microcontroller, operating systems for user interface and data storage as well. Firmware

The Brain and Learning

1878 words - 8 pages properly citing the source of the work, is considered plagiarism. This will result in an unsatisfactory grade for the work submitted or for the entire course. It may also result in academic dismissal from the University. <ECE5001-8 <Herrera> Foundations of Early Childhood Education <Analyzing Brain Research Influence> <Add student comments here>Faculty Use Only<Faculty comments here><Faculty Name&gt

Philosophy

1697 words - 7 pages choose the theater or acting as their career. A comprehensive approach to education can provide windows of opportunities for young people who are willing to open them. When I become a teacher, I want to instill in students an appreciation for literature--even if it doesn’t happen to be one of their passions. To appreciate something is to understand it and this is something I hope my students can leave my class doing. I also hope to

Comentary On Line Training

1607 words - 6 pages strategy for analyzing the data. After this process an evaluative conclusion is drawn that can be used to determine the overall success of the program. An assessment plan should always be included in the design of any training program. Otherwise it becomes difficult to determine the success of the program or to understand what changes will increase its effectiveness (Gordon 17). In order to maintain a training program that can work within

Detecting Wireless LAN MAC Address Spoofing

4074 words - 16 pages . Using Linux open-source drivers, a user can change their MAC address with the ifconfig tool, or with a short C program calling the ioctl() function with the SIOCSIFHWADDR flag. Windows users are commonly permitted to change their MAC address by selecting the properties of their network card drivers in the network control panel applet. An attacker may choose to alter their MAC address for several reasons, including obfuscating their presence

System life cycle

5500 words - 22 pages installed to lay the foundation for bringing the speed of their network to match the other offices at a rate of 100Base-T.Several of the workstations at the Pontiac, MI and Albany, GA locations use Pentium-III or slower processors. Many of these systems are also running Windows 98 as an operating system. These workstations should receive appropriate processing upgrades and OS upgrades to Windows 2000 or replaced entirely. This will make their performance

The Porter Analysis

3306 words - 13 pages created with another program, correctly align mathematical formulas, create and print letters, perform calculations, display documents in multiple on-screen windows, and also enable users to record macros that simplify difficult operations (www.msn.encarta.com). One major manufacturer of typewriters and word processors is Brother. The Personal Computer (PC) or desktop, is a machine capable of repetitively and quickly performing calculations and

Similar Essays

A Forensics Memory Study Of Malware In Android Operating Systems

2744 words - 11 pages attacks when they occur on mature operating system platforms such as Windows and Linux. However, due to the immaturity of Android memory image forensics, it is relatively problematic and time consuming to conduct such investigations on Android systems. In this research, we take advantage of recent advances in Android memory forensics technologies to explore a sample of these malware attacks, utilizing the open source digital forensics Volatility, a

Comparison Of Mac Vs. Pc Essay

1254 words - 5 pages provide in the constantly advancing technological world. In conjunction with computer hardware, the importance of a user-friendly operating system and it's ability to perform an diverse range of tasks is the crucial selling point of the Macs and PC buyers. Again, the two main operating systems in the world is the Macintosh OS (Mac) and the Microsoft Windows OS (PC). Analyzing the operating systems is a bit more difficult because both run similar

The Old Fools, By Philip Larkin

870 words - 3 pages Weddings, and High Windows. His use of vulgar expressions helps to emphasize the main concept in his work and develops a unique writing style of his own. Using his own poetic technique, Larkin conveys his discontentment with his existence and shows the psychological suffering he endured throughout his life. By analyzing Larkin’s poetry, a reader can appreciate the uniqueness of his style and understand the significance of the concepts conveyed

Netxray Manual Essay

1398 words - 6 pages the minimum requirements for the software to operate efficiently.NetXray as a complex software also have some hardware and software requirements. Central Processing Unit: 80386 of 66 Mhz processor is needed Video Display: minimum color monitor with 640x480 dpi is needed. Operating System: NetXray need Windows OS.It supports both Windows 95 and Windows NT. Memory: Minimum 16 MB RAM for Windows 95 and 24 MB for Windows NT Other Hardware : A CD