Bjfezbarbed ` hlvezfj Z~vfK~rsz qlivhf a~lh `~zfa`kz{ be qli`zbifhfhl~r v{bed Qli`zbibzr >%0
A~bj`r) 04
zm
Bez~ljvkzble
Zmb{ jlkvhfez biiv{z~`zf{ ` t`ig(zm~lvdm al~ bjfezbarbed zmf s`zm la `e vegelte abif tmbkm m`{ nffehlvezfj `{ ` Z~vfK~rsz qlivhf% Zmf tl~g b{ jlef `ihl{z fezb~fir v{bed zmf Qli`zbibzr >%0 a~`hftl~g% Bm`qf z~bfj m`~j zl h`gf bz f~~l~(a~ff nvz zmf ljj lef h`r m`qf k~fsz be% Sif`{f affi a~ff zl fh`bi hfkl~~fkzble{%
Zm`eg Rlv
@ nbd zm`eg rlv zl `ii zmf klez~bnvzl~{ zl zmf Qli`zbibzr v{f~ h`bibed ib{z? bz tlvij m`qf nffe ` hvkm hl~fs`beavi f}sf~bfekf tbzmlvz rlv~ mfis) `ej zl O[F) hr kliif`dvf) al~ mb{ feklv~`dfhfez `ej bezf~f{z%
Zlli{ V{fj
Zmf t`ig(zm~lvdm b{ k`~~bfj lvz v{bed Hbk~l{laz Tbejlt{ 4 1:(nbz% Nf{bjf{ Tbejlt{) `ii zlli{ `~f a~ffzl jlteil`j ‛ sif`{f ln{f~qf zmfb~ ibkfe{f{%
Zlli@q`bi`nif A~lh
Qli`zbibzr A~`hftl~g >%0mzzs{?,,ttt%qli`zbif{r{zfh{%klh,jfa`viz,qli`zbibzr,^fd^bssf~ mzzs?,,~fd~bssf~%tl~js~f{{%klh,Tbejlt{ S~fafzkm S`~{f~ mzzs?,,ztl~g{%efz,s~lzlzrsf\s`df%sms<s~lzl\bj80Tbejlt{ V[N [zl~`df S`~{f~ mzzs?,,ztl~g{%efz,s~lzlzrsf\s`df%sms<s~lzl\bj80;
V{favi ^f{lv~kf{
^f{lv~kf@q`bi`nif A~lh
Zmf Qli`zbibzr >%0 klhh`ej ~faf~fekfmzzs?,,kljf%dlldif%klh,s,qli`zbibzr,tbgb,Klhh`ej^faf~fekf>0Zmf Qli`zbibzr v{f~{ h`bibed ib{zmzzs?,,ib{z{%qli`zbif{r{zfh{%klh,h`bih`e,ib{zbeal,qli(v{f~{
Zmf [kfe`~bl
B m`qf nffe s~f{fezfj tbzm `e m`~j jb{g j~bqf -MJJ" tmbkm `ss`~fezir {mlt{ v{f la ` Z~vfK~rszqlivhf) nvz bebzb`i `e`ir{b{ klvij elz bjfezbar zmf abif tmbkm b{ zmf Z~vfK~rsz qlivhf% @{ ` t`r la if`~ebed `nlvz Qli`zbibzr B m`qf jfkbjfj zl {ff ba B k`e bjfezbar zmf abif tmbkm b{ zmf Z~vfK~rsz qlivhfa~lh `~zfa`kz{ be zmf mbnf~abi%{r{%Zmf MJJ {mlt{ ` Tbejlt{ 4 be{z`ii tbzm [f~qbkf S`kg 0 -[S0" `ej m`{ > s`~zbzble{? ` 033HN {r{zfhs`~zbzble -tmbkm b{ zrsbk`i la Tbejlt{ 4" `ej zmf ~fh`bejf~ la zmf MJJ b{ be v{f `{ zmf K j~bqf -K?"% Bm`qf `i~f`jr kleab~hfj zm`z `ii {fkzl~{ `~f `kklvezfj al~) zm`z b{) zmf~f b{ elz ` nilkg la jb{g {s`kftmbkm hbdmz nf ` mbjjfe s`~zbzble tmbkm b{ `kzv`iir ` Z~vfK~rsz qlivhf%
Zmf T`ig(zm~lvdm
[zfs 0? S~fs`~`zble
•
B m`qf k~f`zfj ` alijf~ k`iifj $zk$ -Z~vfK~rsz" le zmf ~llz la hr J j~bqf -J?Yzk"%
•
B m`qf si`kfj ` klsr la qli`zbibzr(>%0%{z`ej`ilef%f}f be zmb{ alijf~%
•
B m`qf klsbfj zmf mbnf~abi%{r{ abif a~lh zmf {v{sfkz MJJ zl zmb{ alijf~%
[zfs >? Dfzzbed zmf ib{z la s~lkf{{f{
Hr ab~{z zmlvdmz t`{ zl z`gf ` illg `z tm`z s~lkf{{f{ klvij nf alvej a~lh zmf mbnf~abi%{r{% Zmf Qli`zbibzrsivdbe al~ zmb{ b{s{ib{z?
J?Yzk5qli`zbibzr(>%0%{z`ej`ilef%f}f (a mbnf~abi%{r{ ((s~labif8Tbe4[S0}1:((lvzsvz(abif8s{ib{z%z}z s{ib{z
@{ bz${ zmf ab~{z zbhf) ifz${ n~f`g zmb{ klhh`ej ibef jlte?
qli`zbibzr(>%0%{z`ej`ilef%f}f
Zmf f}f la zmf Qli`zbibzr a~`hftl~g
(a mbnf~abi%{r{
Zmf a {tbzkm {sfkbabf{ zmf abif le tmbkm zl lsf~`zf
((s~labif8Tbe4[S0}1:
Zmf s~labif {sfkbabf{ zmf L[ a~lh tmbkm zmf abif klhf{
((lvzsvz(abif8s{ib{z%z}z
[`qf lvzsvz zl ` abif ~`zmf~ zm`e {zjlvz -zmf {k~ffe"
s{ib{z
Zmf s`~zbkvi`~ Qli`zbif a~`htl~g sivdbe zl ~veB jfibnf~`zfir {sfkbar zmf `~dvhfez{ be zmb{ l~jf~ nfk`v{f bz h`gf{ bz f`{bf~ zl ~ve lzmf~ sivdbe{? B k`e{bhsir v{f zmf vs `~~lt zl {mlt zmf i`{z klhh`ej `ej zmfe fjbz zmf i`{z ztl s`~`hfzf~{ la zmfklhh`ej% B `ihl{z `it`r{ lvzsvz zl ` abif `{ zmb{ `iilt{ hf zl h`ebsvi`zf bz be dqbh -l~ lzmf~ zlli{" `ejlazfe B al~dfz bhsl~z`ez jfz`bi{ a~lh ` s`~zbkvi`~ sivdbe `ej {l B k`e {bhsir ~faf~ n`kg zl zmf {`qfjlvzsvz ~`zmf~ zm`e m`qbed zl ~f~ve zmf klhh`ej%Tmfe zmf klhh`ej abeb{mfj B lsfefj vs s{ib{z%z}z% B m`qf {ebssfj `ej zbjbfj zmf lvzsvz al~ ~f`j`nbibzr%
Laa{fz-Q" E`hf SBJ SSBJ Zmj{ Mej{ [f{{ Tlt1: [z`~z
3}aaaaa`=331kfa2f3[r{zfh:30;66;3((((((3>30>(34(>23=?0;?663}aaaaa`=33`>:fn;3tbebebz%f}f:1:;=:;4233>30>(34(>23=?0:?3;3}aaaaa`=33`366n;3{f~qbkf{%f}f6>3:1:0>>6333>30>(34(>23=?0:?3:3}aaaaa`=33`=6>=43tbeildle%f}f1;1:6160>403>30>(34(>23=?0:?313}aaaaa`=33n3>fn;3f}sil~f~%f}f>2>3>=;>=>>>6003>30>(34(>23=?0:?>43}aaaaa`=33n:23n;3J~lsnl}%f}f;:41>2>3>060100>30>(34(>23=?0:?663}aaaaa`=3340;a113Z~vfK~rsz%f}f;6>3>>>::>>400>30>(34(>23=?0=?:1
@{ k`e nf {ffe) zmf~f b{ ` Z~vfK~rsz%f}f s~lkf{{) {z`~zfj `z 3=?0=?:1) tmbkm m`{ ` S~lkf{{ BJ -SBJ" la ;6>3% Zmf~fal~f) Z~vfK~rsz b{ ~veebed ‛ zmf~f t`{ el F}bz zbhf al~ zmf s~lkf{{%
[zfs ;? @ ib{z la jfqbkf{
@{ zmf Z~vfK~rsz abif b{ hlvezfj `{ ` qlivhf bz b{ zmf~fal~f ` jfqbkf ( bz {mlvij nf sl{{bnif zl {ff{lhfzmbed bejbk`zbqf la Z~vfK~rsz v{bed zmfjfqbkfz~ff sivdbe?
J?Yzk5qli`zbibzr(>%0%{z`ej`ilef%f}f (a mbnf~abi%{r{ ((s~labif8Tbe4[S0}1:((lvzsvz(abif8jfqbkfz~ff%z}z jfqbkfz~ff
Al~ zmb{ klhh`ej B m`qf {bhsir km`edfj zmf lvzsvz abif `ej zmf sivdbe e`hf% Zmf lvzsvz abif klez`be{=0> ibef{ tmbkm B {f`~kmfj al~ Z~vfK~rsz% B dlz ; ~f{viz{?J^Q 3}>;f`06jf3 YJ~bqf~Yz~vfk~rsz(((y JFQ 3}aaaaa`=332:1a3=3Z~vfK~rszQlivhfD ABIF\JFQBKF\JB[G(((y JFQ 3}aaaaa`=3340>4`k3Z~vfK~rszABIF\JFQBKF\VEGELTE
Elzf Z~vfK~rszQlivhfD ( zm`z zfii{ v{ zm`z zmf~f b{ ` Z~vfK~rsz qlivhf hlvezfj `{ zmf D j~bqf -
D?
"%Tf gelt zm`z ` Z~vfK~rsz s~lkf{{ b{ ~veebed `ej tf gelt zmf~f b{ ` Z~vfK~rsz qlivhf h`ssfj `{
D?
%
[zfs :? Dfzzbed m`ejif{ `{{lkb`zfj tbzm zmf Z~vfK~rsz s~lkf{{
@{ tf m`qf zmf SBJ la zmf Z~vfK~rsz s~lkf{{ tf k`e illg al~ m`ejif{ ltefj nr zm`z s~lkf{{% Ba tf$~fivkgr) zmf~f tbii nf ` Abif m`ejif zl lv~ Z~vfK~rsz qlivhf abif% Zmf sivdbe al~ m`ejif{ b{m`ejif{%M`ejif{ m`{ ` evhnf~ la s`~`hfzf~{ zl `iilt v{ zl `ssir abizf~{ zl tm`z b{ ~fzv~efj% Tf `~f dlbed zlv{f zmf
((sbj
s`~`hfzf~ zl abizf~ ov{z al~ lv~ Z~vfK~rsz s~lkf{{ `ej zmf
(z
-zrsf" s`~`hfzf~ zl abizf~ al~ leir m`ejif{ la zrsf Abif?
J?Yzk5qli`zbibzr(>%0%{z`ej`ilef%f}f (a mbnf~abi%{r{ ((s~labif8Tbe4[S0}1:((lvzsvz(abif8m`ejif{(;6>3(abif{%z}z m`ejif{ ‛sbj8;6>3 (z Abif
Lekf abeb{mfj) zmf lvzsvz illg{ ibgf zmb{?
Laa{fz-Q" Sbj M`ejif @kkf{{ Zrsf Jfz`bi{
3}aaaaa`=33403`0k3;6>33}0k3}0333>3AbifYJfqbkfYM`~jjb{gQlivhf;Y3}aaaaa`=3343a1343;6>33}>33}0333>3AbifYJfqbkfYM`~jjb{gQlivhf>YTbejlt{Ytbe{}{Y}=1\hbk~l{laz%tbejlt{%klhhle(klez~li{\1626n1:0::kka0ja\6%=>%4130%0460:\elef\fk=;jaa `=620:2`a 3}aaaaa`=331a jnk23;6>33}=:3}0>33=2AbifYJfqbkfYM`~jjb{gQlivhf>YTbejlt{Y[r{TLT1:Yfe(V[Y{fzvs`sb%jii%hvb3}aaaaa`=331j4:143;6>33}kk3}033330AbifYJfqbkfYG{fkJJ3}aaaaa`=3343fk6=3;6>33}0333}0333>3AbifYJfqbkfYM`~jjb{gQlivhf>YTbejlt{Ytbe{}{Y}=1\hbk~l{laz%tbejlt{%klhhle(klez~li{\1626n1:0::kka0ja\1%3%4130%0460:\elef\:0f1246f>nj1a>n>3}aaaaa`=33431fjj3;6>33};>=3}0333=3AbifYJfqbkfYZ~vfK~rsz3}aaaaa`=331j4k=`3;6>33};4:3}0>33=2AbifYJfqbkfYM`~jjb{gQlivhf>YTbejlt{YAlez{Y [z`zbkK`kmf%j`z3}aaaaa`=33n:3=;43;6>33};4=3}0>33=2AbifYJfqbkfYM`~jjb{gQlivhf>YTbejlt{Y[r{TLT1:Yfe(V[Yv{f~;>%jii%hvb3}aaaaa`=331f`>0=3;6>33};2:3}0333>3AbifYJfqbkfYM`~jjb{gQlivhf>YTbejlt{Ytbe{}{Y}=1\hbk~l{laz%tbejlt{%klhhle(klez~li{\1626n1:0::kka0ja\1%3%4130%0460:\elef\:0f1246f>nj1a>n>
Zmf~f b{ elzmbed f{sfkb`iir elz`nif f}kfsz h`rnf
YJfqbkfYM`~jjb{gQlivhf;Y
% @{ s~fqblv{ir{z`zfj) zmf MJJ leir m`{ ztl s`~zbzble{ {l tmr jlf{ Z~vfK~rsz m`qf ` m`ejif zl ` zmb~j qlivhf< Zmf~fhv{z nf `elzmf~ qlivhf `zz`kmfj be {lhf t`r% Zmf abif{ tmbkm Z~vfK~rsz m`{ ` m`ejif le `ii {ffhqf~r ~f`{le`nif al~ ` Tbejlt{ `ssibk`zble? alez{ `ej klhhle klez~li{%[l tf jbje$z dfz ivkgr? elzmbed mf~f {ffh{ zl nf zmf Z~vfK~rsz qlivhf%
[zfs 6? Illgbed vs {rhnlibk ibeg{
@ej~ft K`{f le zmf Qli`zbibzr v{f~{ h`bibed ib{z beal~hfj hfzm`z?’HMI {vddf{zfj v{bed zmf {rhibeg {k`e klhh`ej `{ zmb{ tbii h`s j~bqf ifzzf~{ zl smr{bk`i
Identifying a mounted TrueCrypt volume from artefacts in volatile memory using Volatility 2.1
This document illustrates a walk-through for identifying the path of an unknown file which has been mounted as a TrueCrypt volume. The work is done almost entirely using the Volatility 2.1 framework.
5.7K
Reads
2
Readcasts
5
Embed Views
Recommended
Notes
Load more
