Linux memory forensic acquisition

With release of such tools as Volatility, acquiring RAM images becomes really useful. We already talked about Windows memory acquisitions with Belkasoft Ram Capturer, but today we’ll show you how to acquire Linux memory with The Linux Memory Extractor (LiME).

Let’s start from downloading the tool. You can use this link to do it. Of course, you MUSTN’T do it on the subject system, use your Linux forensic workstation.

Now we should build LiME according to the subject system’s kernel version. How to get its kernel version? It’s easy – use the following terminal command:

uname -a

In our case the kernel version is “3.5.0-23-generic”:

OK, we are ready to build LiME. Unzip the archive you downloaded, in our case it’s LiME-master.zip. Now change directory to LiME-master/src. Use the following command:

make -C /lib/modules/3.5.0-23-generic/build M=$PWD

Here is the command’s output:

make: Entering directory `/usr/src/linux-headers-3.5.0-23-generic’

  LD      /home/olly/Desktop/LiME-master/src/built-in.o

  CC [M]  /home/olly/Desktop/LiME-master/src/tcp.o

  CC [M]  /home/olly/Desktop/LiME-master/src/disk.o

  CC [M]  /home/olly/Desktop/LiME-master/src/main.o

  LD [M]  /home/olly/Desktop/LiME-master/src/lime.o

  Building modules, stage 2.

  MODPOST 1 modules

  CC      /home/olly/Desktop/LiME-master/src/lime.mod.o

  LD [M]  /home/olly/Desktop/LiME-master/src/lime.ko

make: Leaving directory `/usr/src/linux-headers-3.5.0-23-generic’

Now we have lime.ko file in the src directory. It’s highly recommended to add the kernel version to file’s name, in our case – lime-3.5.0-23-generic.ko, and add it to your LiME kernel modules collection for future use.

OK, let’s use our kernel module to dump RAM. LiME supports three types of image formats: raw, padded and LiME. The authors of the Volatility memory analysis framework recommend LiME format, so we will use it in our example. Let’s start from copying our kernel module (lime-3.5.0-23-generic.ko) to the IR thumb drive. Make sure there is enough space on the drive to store memory dump!

Plug it to the subject Linux machine mount it (usually it’s mounted automatically on modern Linux systems). In our case it’s mounted on /media/Forensics.

Open the terminal and change directory to your drive. Now use the following command:

sudo insmod lime-3.5.0-23-generic.ko path=/media/Forensics/ram.lime format=lime

That’s it, now we have a Linux memory image on our thumb drive:

This image can be analyzed with the Volatility memory analysis framework, for example. Next time we’ll show you how to do it. Keep reading us!

About the authors:

Igor Mikhaylov

Interests: Computer, Cell Phone & Chip-Off Forensics

Oleg Skulkin

Interests: iOS forensics, Android forensics, Mac OS X forensics, Windows forensics, Linux forensics