Browse > Article
http://dx.doi.org/10.13089/JKIISC.2014.24.5.861

An improved extraction technique of executable file from physical memory by analyzing file object  

Kang, Youngbok (Chonnam National University)
Hwang, Hyunuk (The Attached Institute of ETRI)
Kim, Kibom (The Attached Institute of ETRI)
Noh, Bongnam (Chonnam National University)
Publication Information
Journal of the Korea Institute of Information Security & Cryptology / v.24, no.5, 2014 , pp. 861-870 More about this Journal
Abstract
According to the intelligence of the malicious code to extract the executable file in physical memory is emerging as an import researh issue. In previous physical memory studies on executable file extraction which is targeting running files, they are not extracted as same as original file saved in disc. Therefore, we need a method that can extract files as same as original one saved in disc and also can analyze file-information loaded in physical memory. In this paper, we provide a method that executable file extraction by analyzing information of Windows kernel file object. Also we analyze the characteristic of physical memory loaded file data from the experiment and we demonstrate superiority because the suggested method can effectively extract more of original file data than the existing method.
Keywords
Physical Memory Forensic; File Mapped Data; File Object;
Citations & Related Records
연도 인용수 순위
  • Reference
1 Matthieu Suiche, "Windows Hibernation File for Fun 'N' Profit," BlackHat USA, Aug. 2008.
2 James Butler, Justin Murdock, "Physical Memory Forensics for Files and Cache," Defcon 19, July. 2011.
3 Mark E. Russinovich, David Solomon,Alex Ionescu "Windows Internal 5th edition," Acorn, pp. 956-962, Jul. 2010.
4 Brendan Dolan-Gavitt, "The VAD tree: A process-eye view of physical memory," DIGITAL INVESTIGATION 4S, pp. 62-64, Sep. 2007.
5 Volatility procexedump,https://code.google.com/p/volatility/wiki/CommandReference23#procexedump
6 Rekall, http://www.rekall-forensic.com/docs/Manual/Plugins/Windows/PEDump.html
7 Mandiant Memoryze, https://www.mandiant.com/resources/download/memoryze