Catching the ghost: how to discover ephemeral evidence with Live RAM analysis

Oleg Afonin and Yuri Gubanov © Belkasoft Research

Belkador Dali. “Losing volatile Evidence”.
All rights reserved.

Published in DFI Magazine, May 2013 


Ephemeral Evidence

Until very recently, it was a standard practice for European law enforcement agencies to approach running computers with a “pull-the-plug” attitude without recognizing the amount of evidence lost with the content of the computer’s volatile memory. While certain information never ends up on the hard drive, such as ongoing communications in social networks, data on running processes or open network connections, some other information may be stored securely on an encrypted volume. By simply pulling the plug, forensic specialists will slam the door to the very possibility of recovering these and many other types of evidence.

The Role of Live RAM Analysis in Today’s Digital Forensics

Capturing and analyzing volatile data is essential for discovering important evidence. Making a RAM dump should become a standard operating procedure when acquiring digital evidence before pulling the plug and taking the hard drive out.

Please register to access full versions of Belkasoft articles

Oleg Afonin and Yuri Gubanov © Belkasoft Research