Learning about the investigation goals and methodology
The basis of any forensic investigation is goal setting. Goals determine evidence to look for, methods to use, and tools we need. The right approach to goal setting helps to achieve the desired result quickly and efficiently. Remember the famous "divide et impera" principle? Despite its origins and primary purpose, this principle is great for achieving any goals, the main thing is to understand what to divide and how to use it. As part of the investigation goal setting, this principle can be used to break down the primary goal into smaller and simpler ones. Thus, by dividing our goals into components, we get a set of specific actions, the result of which will be the pieces of the puzzle and all we will have to do is to put them together.
Let's start with the more general goals. If we receive for examination the device involved in the incident, there is a high probability that it is either one of the following:
- The alleged victim's device
- The suspect's device
Let's look at what both are in the next sections.
The victim's device
Consider a situation in which the victim's device is under investigation. The main goal in this case is to answer the question, What happened? One way is to break this question down into its components:
- How did an attacker gain access to the system?
- What tools were launched?
- Did the attacker get persistence?
- Was there a lateral movement?
- What actions on the objective were performed?
Now let's do the same thing with the question, How did the attacker gain access to the system?:
- Are there any traces of potentially malicious files/links having been opened?
- Are there any remote connection services running?
- Are there any traces of suspicious connections?
- Are there any traces of removable devices being connected?
Let's ask questions about malicious files too:
- Are there any traces of suspicious files saved?
- Are there any traces of suspicious links opened?
- Are there any traces of suspicious files opened?
Finding answers to these questions requires not only knowledge of the digital artifacts and their sources but also the attacker's tactics, techniques, and procedures, so such assessments must also be cyber threat intelligence-driven.
This is the level to which each upper-level question should be broken down. As a result, we have a final list of questions that will allow us to piece together a picture of the incident and answer the first question of What happened? in detail.
The suspect's device
A similar method can be used to investigate the device from which the attacks are suspected to have originated. In this case, questions would be posed based on what the owner of the device is suspected of. For example, if they are suspected of being a malware developer, our questions would be related to the presence of development tools, traces of source code, sales of malware, and so on.
So, we have discussed how memory forensics can help our investigation and what methodology we can apply to do so. However, we cannot remain silent and overlook the weaknesses and possible risks. Let's discuss the challenges of memory forensics.