+- AiOwares (https://www.aiowares.com)
+-- Forum: Cyber & Forensics (https://www.aiowares.com/forumdisplay.php?fid=65)
+--- Forum: Digital Forensic Analysis (https://www.aiowares.com/forumdisplay.php?fid=68)
+--- Thread: Importance of RAM State in Digital Forensic Analysis (/showthread.php?tid=1434)
Importance of RAM State in Digital Forensic Analysis - MaskedUser - 11-13-2019
Digital forensic experts understand the importance of remembering to perform a RAM Capture on- Crime Scene Investigation so as to not leave valuable evidence behind. Capturing volatile data in a computer's memory dump enables investigators and examiners to do a full memory analysis and access data including:
browsing history
encryption keys
chat messages
clipboard contents
run-time system activity
open network connections (often these artifacts are only found in RAM)
recently executed commands and processes
injected code fragments
memory stored before shut down or crash
The practice of RAM Capture is an important aspect of memory forensics that can be used during a digital forensic investigation of criminal activity, hacking, cyber crime or insider threats. In the case of hacking, attackers sometimes develop malware that only lives in memory which makes it difficult to detect if random access memory is not captured.