- In this segment, we're gonna take a look
at the importance of RAM capture.
Now, you might notice some 2020 file dates.
In this lesson, this is a lab
I created for the SYO 601 course
and I liked it so much that we're reusing it.
And it still is relevant today, as it was then.
All I do at that point is click capture
and it's going to capture all of the RAM
and it's going to put it into a file
that has a dot m e m extension.
Now to save time, I've already taken care of that
and done that. So then what do we do next?
Well, let's close that up.
The next thing we have to do,
is we have to import that file
into a Evidence analysis program.
I happen to be using Evidence Center.
Again, this is a Belkasoft program.
To import the data, I just could go
into a data source and it says,
what's your data source?
Are you importing data from the cloud?
From a drive? From a mobile device?
Or coming up here from a RAM image?
And there is the full path
to the RAM memory image file that I created.
I've already brought that into Evidence center
and had it do its analysis, looking for artifacts.
Because it takes quite a while to do that.
So what was the output? Well, here's what's really amazing.
Right? I have a predefined search.
It says, look for Windows full path, look for phone numbers,
postal codes, URLs, payment card numbers, IP addresses,
email addresses or search engine results.
And a total of 3,026 artifacts were identified in RAM.
Now, the majority of them are pictures, 1,381.
But then Internet Explorer links, Chrome links,
link files, and then others.
So contacts and various types of artifacts.
I wanna get an overview, again,
I can look at what all of those files are,
whether it's jump lists or perhaps it's pictures,
chats that I may have had. Right?
They're all gonna be showing up right here.
I can also get a timeline
of all of the activity that happened.
That's being collected, you know,
that was being extracted from RAM.
As well as just additional information
about all of the data.
But again, just thinking about this.
This is the information that's in RAM,
the pictures, the jump lists, the mails,
the chats, the URLs, contacts, documents.
Now of course, I'd also be doing forensics on the drive
but this is gonna give me a snapshot
of what was happening as close to the incident as possible,
which is why it's really important
to collect evidence quickly and to make sure
that you collect all the evidence you can
in a forensically sound, non contaminated manner.
So that then you can actually use that information
to do your analysis, and ultimately to build a case
that will be accepted in court.
You know, forensics is such an incredibly fascinating field.
It's absolutely, it's one of my favorites.
So, you know, as you're pondering your career path
this is one that I absolutely encourage you to explore.
And that my friends is a closer look at RAM capture.