Belkasoft Capture Tool

In order to extract ephemeral evidence out of already captured memory dumps, forensic experts must use proper analysis software such as Belkasoft X. Besides, some other tools can be used to extract passwords to encrypted volumes.

Testing methodology: we launched Karos, a computer game protected with nProtect GameGuard. Then we performed an active chat session, and tried acquiring the complete memory dump of the system with all three memory dumping tools. We then analyzed the memory set belonging to the protected game.

In worst-case scenarios, an anti-debugging system detecting an attempt to read protected memory areas may take measures to destroy affected information and/or cause a kernel mode failure, locking up the computer and making further analysis impossible. This is what typically happens if a user-mode volatile memory analysis tool is used to dump content protected with a kernel-mode anti-debugging system.

Belkasoft Live RAM Capturer is compatible with 32-bit and 64-bit editions of Windows including XP, Vista, Windows 7/8/10/11, 2003 and 2008 Server. The tool does not require installation, and can be launched in seconds from a USB thumb drive.

Since this article was published, FTK Imager got a kernel-mode driver. However, you may still consider to compare size of an executable file to select a capturer with minimum footprint. See a third-party review at -of-memory-acquisition-software-for-windows-e8c6d981db23

Belkasoft X can extract potentially crucial information from volatile memory, such as: in-private browsing and cleared browser histories, online chats and social networks, cloud service usage history, and much more. Belkasoft Live RAM Capturer is a powerful tool for creating memory dumps, and it is complimentary.

Through its File System window, Hex Viewer, and Type Converter tools, Belkasoft X allows you to perform deep examinations into the contents of files and folders from devices. With its customizable File and Data carving functions, you get to recover deleted and hidden artifacts and perform memory process analysis to view alive and dead processes in memory dumps. You can also use its hash algorithms to run searches against hash sets (NSRL RDSv3 and ProjectVic formats included).

X Forensic edition is the complete solution for conducting in-depth investigations on all types of digital media devices and data sources, including computers, mobile devices, RAM and the cloud. It is an irreplaceable analytical tool for digital forensic laboratories of federal law enforcement agencies and state-level police departments.

An internal comparison between Belkasoft Live RAM Capturer and latest versions of competing RAM acquisition tools demonstrated the ability of Belkasoft Live RAM Capturer to acquire an image of a protected memory set while the other tools returned an empty area (FTK Imager) or random data (PMDump).Tools tested:AccessData FTK Imager 3.0.0.1443PMDump 1.2Belkasoft Live RAM Capturer 1.0Testing methodology: we launched Karos, a computer game protected with nProtect GameGuard. Then we performed an active chat session, and tried acquiring the complete memory dump of the system with all three memory dumping tools. We then analyzed the memory set belonging to the protected game.The results:AccessData FTK Imager 3.0.0.1443 contained all zeroes in place of actual data for the protected memory set;PMDump 1.2 returned random data;Belkasoft Live RAM Capturer 1.0 correctly acquired the protected memory set.Consequences of Using a Wrong Tool

Capture the content of the computer's volatile memory in a forensically sound way. This free kernel-mode tool comes with 32-bit and 64-bit drivers to overcome active anti-debugging and anti-dumping protection systems such as nProtect GameGuard. Developed by a forensic research company, Belkasoft RAM Capturer requires no installation and leaves as small a footprint as theoretically possible.

Belkasoft RAM Capturer is a kernel-mode tool designed to capture the content of the computer's volatile memory in a forensically sound way. Developed by a forensic research company, Belkasoft RAM Capturer requires no installation and leaves as small a footprint as theoretically possible. Coming with 32-bit and 64-bit kernel-mode drivers, Belkasoft RAM Capturer is able to overcome most current anti-debugging and anti-dumping protection systems such as nProtect GameGuard. Unlike many other memory

There are many nuances to an effective memory dump as a first step. This process alone has many pitfalls, one is a very wide-spread (not only all too common but frequently costly) mistake of using a forensic tool with a lot of capabilities and a large memory footprint. An example would be FTK Imager, an excellent tool for various types of acquisition, but a tool that requires far too much memory to be your tool of choice for RAM dumping. Its size is over 20 megabytes, while there are many other tools on the market that are hundreds of times smaller. Needless to say, the larger your tool of choice, the more user data is overwritten in memory when you run it, because the executable is loaded into memory to run.

Some tools can help you create a user vocabulary as well. In our flagship DFIR product, Belkasoft X, this capability is called 'Create key dictionary'. This function is available from the product's Dashboard. Other tools, such as Passware Kit Forensic, can not only attempt to check every term from a key dictionary, but also create so-called mutations and combine different terms into one password. Though the number of mutations and combinations is naturally very large, it is still the best and most efficient approach identified for decryption to date.

Your forensic tool may further this confusion for a variety of artifacts if the timestamps are not accurately converted. The issue deepens if you have several data sources from different time zones (e.g. a computer hard drive from Arizona and an iPhone from Washington DC). The forensic tool you choose must allow you to specify different time zones for different devices in your case in order to avoid any timestamp confusion. Not specifying a time zone offset in such a case is another facet to the same mistake.

Mistake #10: Bricking a mobile device in evidenceThe more mobile devices evolve, the harder it is to capture data from them. Physical images, available when the first smartphone was introduced, are no longer viable due to built-in encryption features. And, standard backups offer a very limited amount of data. This is why most modern approaches to acquire smart device data are based on known vulnerabilities and subsequent exploits.

In this article we will be going to learn the how to capture the RAM memory for analysis, there are various ways to do it and let take some time and learn all those different circumstances call for a different measure.

Capturing RAM important task as over the time investigators have realized that many types of facts can be covered in volatile memory and evidence can beneficial in an investigation and which can further allow an investigator to understand what applications were being used by a suspect or at the time of the attack. It can also be possible that remote attackers would have some stored data, tools in RAM rather than on the system.

As we can see in the above image this tool is already providing us with the destination of the image that we are going to create by this process and asking us at the user end we want to continue or not.

Magnet Forensics is a free RAM capturing or memory imaging tool which is used to capture the physical memory of suspects system, allows investigators to analyse and recover the valuable facts that are only found in the memory of the system.

Magnet Ram capture has a small memory footprint, that means investigator can run the tool while data is overwritten in memory. We can capture memory data in Raw (.DMP/.RAW/.BIN) format and easily analyse them.

After completing the process, it shows a pop-up message which indicates the process is successful and provides us the path location were our captured memory is located which we were provided earlier by us.

It is a free forensic tool to reliably extract all content of the system volatile memory, even if it was protected by some active anti-debugging system. Were its separate 32bit and 64bit builds are available to minimize the tool footprint as much as possible.

After providing all the details it starts to load its drivers to start the process of capturing the memory image, now it shows the active live progression of the task given by us to capture the memory image.

Magnet RAM Capture is a new player in the market. Supports Windows systems including XP, Vista, 7, 8, 10, 2003, 2008, and 2012. Magnet RAMCapture has nice and simple GUI so running it is very straightforward. It creates a raw memory dump with a .DMP extension. If you are runningthe tool from a FAT32 formatted USB stick and the host RAM you are capturing is greater than 4 GB, then segmentation feature will be veryhelpful (it is disabled by default).

WinPMEM is actively developed open source utility. It is part of Rekall Memory Framework. WinPMEM has never let me down. It acquired64GB memory image from Windows 2008 Server. Compared to the previously described tools, WinPMEM has a number of interesting features:

Starting from the acquisition phase, where the product helps you to copy a hard drive, create a smart mobile device dump, capture RAM memory and even download Google Drive or iCloud, to creation of reports in numerous formats, the product eases all routine operations of your investigation. 2b1af7f3a8

Belkasoft Capture Tool

Subscribe to Receive PBN Updates!