How to analyze RAM through Kali Linux Forensics mode
Jacob Mehnert and one other contributor
Last updated on Jul 11, 2022
Views: 3.2K
View statistics:
- Past 24 Hours:
- 5
- Past 7 Days:
- 28
- Past 30 Days:
- 105
- All Time:
- 3,193
Comments: 2
2 comments on steps.
Completed: 1 2
1 person has marked this guide "completed." Will you be next?
2 people have marked this guide "completed." Including you — great job!
Favorites: 0 1
No one has favorited (and subscribed to) this guide. Will you be the first?
1 person has favorited (and subscribed to) this guide — and that's you!
Community-Contributed Guide
An awesome member of our community made this guide. It was not created by iFixit staff.
Introduction
Go to step 1 ↓Much like how a memory analysis can be done on a hard drive, memory analysis can also be done on RAM modules. Because RAM is a volatile memory source, which means as soon as it is turned off it will loose data.
However, one of the cool things that can be done with memory analysis is that a user can recreate what was happening when an issue occurred by using the Volatility application.
What you need
Parts
Tools
-
-
-
Plug in your Live Kali Linux USB into your computer and restart your PC.
-
Once your machine is finished restarting you should see Kali's Boot Loader.
Ask FixBot
-
-
-
Choose Live (forensic mode) from the list of options.
-
-
-
-
-
-
Press Ctrl + Alt + T to open the Terminal Interface.
-
-
-
Navigate to the Volatility directory with the command: cd /usr/share/volatility
-
-
-
Search for the RAM's profile with: python vol.py imageinfo -f=<location of image file>
-
-
Because Volatility is a Python script, you can enter the command python vol.py -h to gain additional information.
The most important thing you should take away from this guide is to remember to use this information responsibly. Obtaining unauthorized access to another's computer system or systems is illegal under the Computer Fraud & Abuse Act.
Please use the knowledge gained from this guide responsibly.
Cancel: I did not complete this guide.
One other person completed this guide.
