Skip to Main content Skip to Navigation
Conference papers

A Tool for Volatile Memory Acquisition from Android Devices

Abstract : Memory forensic tools provide a thorough way to detect malware and investigate cyber crimes. However, existing memory forensic tools must be compiled against the exact version of the kernel source code and the exact kernel configuration. This poses a problem for Android devices because there are more than 1,000 manufacturers and each manufacturer maintains its own kernel. Moreover, new security enhancements introduced in Android Lollipop prevent most memory acquisition tools from executing.This chapter describes AMExtractor, a tool for acquiring volatile physical memory from a wide range of Android devices with high integrity. AMExtractor uses /dev/kmem to execute code in kernel mode, which is supported by most Android devices. Device-specific information is extracted at runtime without any assumptions about the target kernel source code and configuration. AMExtractor has been successfully tested on several devices shipped with different versions of the Android operating system, including the latest Android Lollipop. Memory images dumped by AMExtractor can be exported to other forensic frameworks for deep analysis. A rootkit was successfully detected using the Volatility Framework on memory images retrieved by AMExtractor.
Document type :
Conference papers
Complete list of metadatas

Cited literature [20 references]  Display  Hide  Download

https://hal.inria.fr/hal-01758679
Contributor : Hal Ifip <>
Submitted on : Wednesday, April 4, 2018 - 4:47:49 PM
Last modification on : Wednesday, April 4, 2018 - 4:55:47 PM

File

431606_1_En_19_Chapter.pdf
Files produced by the author(s)

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Haiyu Yang, Jianwei Zhuge, Huiming Liu, Wei Liu. A Tool for Volatile Memory Acquisition from Android Devices. 12th IFIP International Conference on Digital Forensics (DF), Jan 2016, New Delhi, India. pp.365-378, ⟨10.1007/978-3-319-46279-0_19⟩. ⟨hal-01758679⟩

Share

Metrics

Record views

265

Files downloads

1643