Memory & Disk Forensics

Overview

Given a memory dump and disk image from a Windows XP machine, the task was to reconstruct what happened on it: what was running, whether anything looked like malware, and what evidence survived after the user ran cleanup tools.

Approach

• Acquired a forensic image from an offline hard disk over a write-blocked SATA-to-USB connection using Guymager, documenting every step and tool version to preserve chain of custody,
• Identified the memory dump’s OS with Volatility’s imageinfo plugin (Windows XP SP3), then used pslist and psxview to check for hidden or masked processes, finding none,
• Ran malfind on the memory image and found two browser processes with writable-and-executable memory regions, a pattern consistent with code injection,
• Used Scalpel to carve deleted files directly off the disk image, and manually reviewed the mounted filesystem for artefacts such as the Tor Browser installer and files referencing malware and phishing test material,
• Cross-referenced Volatility’s memory timeline with fls/mactime on the disk to build a single timeline of the session, browsing, a Tor Browser launch, and CCleaner running shortly before shutdown.

Outcome

The investigation surfaced suggestive evidence rather than definitive proof: writable-and-executable memory inside two browser processes, consistent with code injection, and evidence of malware and phishing test material accessed through Tor, shortly before CCleaner ran and likely removed part of the trail.