Digital Forensics and Incident Response - Second Edition

Memory analysis with strings

In the previous sections, the Redline and Volatility tools focused on those areas of the memory image that are mapped. In the event that data is not properly mapped, these tools would be unable to extract the data and present it properly. This is one of the drawbacks of these tools for memory analysis. There is a good deal of data that will become unstructured and invisible to these tools. This could be the case when network connections are shut down or processes are exited. Even though they may not show up when the RAM is examined via Redline or Volatility, trace evidence will often still be present.

One tool that is useful for extracting these traces is the strings command present in many of the Linux and Windows ...