目录

一、基本概念

二、运行内存镜像的获取

2.1 Windows内存镜像获取

2.1.1 Magnet RAM Capture获取内存镜像

2.1.2 AccessData FTK Imager软件获取内存镜像

2.1.3 DumpIt软件获取内存镜像

2.1.4 额外知识补充：

2.2 Linux\Mac OS 下内存镜像获取方法

 三、内存信息取证与分析

3.1 volatility安装

3.1.1 Windows

3.1.2 Linux

         3.2 内存取证命令

3.2.1 获取镜像信息

3.2.2 查看用户

3.2.3 查看用户SID

3.2.4 查看用户名密码

 3.2.5 查看LSA密钥信息

3.2.6 查看系统浏览器的浏览记录

3.2.7 查看网络连接情况

3.2.8 查看服务

3.2.9 查看进程

3.2.10查看进程树：

3.2.11 查看cmd历史命令

3.2.12 查看文件

3.2.13 获取主机名

3.2.14 查看注册表配置单元

3.2.15 事件时间线信息

3.2.16 查看剪切板信息

3.2.17 系统最后一次关机时间

一、基本概念

注意：

        内存镜像和磁盘分区镜像是不一样的。计算机内主要的存储部件是内存和磁盘，磁盘中存储着各种数据，而存储的程序是必须加载到内存中才能运行（即程序在内存中运行）。

1. 磁盘分区镜像文件后缀有*.dd、*.E01、*. qcow2等。
2. 内存镜像文件后缀有*.raw、*.mem、*.dd等。 

二、运行内存镜像的获取

2.1 Windows内存镜像获取

2.1.3 DumpIt软件获取内存镜像

        双击软件即可运行，输入“y”，即开始制作当前机器的内存镜像。内存镜像默认保存在“DumpIt软件所在的目录”，镜像名格式默认为“主机名+当前时间”。

2.1.4 额外知识补充：

• 断电情况下：Windows还使用页交换文件（Pagefile.sys）来协助内存的工作，当内存不满足系统所需的情况下，会释放部分内存数据到Pagefile.sys文件中，因此，当设备断电后，若无法拿到内存镜像，可以通过分析Pagefile.sys文件获取有价值的内存数据。
• 休眠情况下：当Windows系统处于休眠状态下，系统会在磁盘中生成一个休眠文件（Hiberfil.sys）用于存放内存中的数据，当计算机重新加电时，又将休眠文件中的数据重新写到物理内存中 ，这个文件也会包含很多价值的内存数据。

1. powercfg -a查询是否支持休眠，
2. powercfg -h off,即可关闭休眠功能，
3. powercfg -h on，就能开启休眠功能。

2.2 Linux\Mac OS 下内存获取方法

LiME：GitHub - 504ensicsLabs/LiME: LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition. - GitHub - 504ensicsLabs/LiME: LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.https://github.com/504ensicslabs/lime (获取镜像)

lmg-master：https://github.com/halpomeranz/lmg/ （配合LiME获取镜像，简化操作）

将lmg-master内文件放入LiME的src文件夹，运行sudo ./lmg 搞定。

 三、内存信息取证与分析

3.1 volatility安装