search

diogo-fernan / ir-rescue

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
Other
459 stars 94 forks source link

Improve Linux memory collection with AVLM #19

Closed mczap closed 3 years ago

mczap commented 3 years ago

Linpmem read /proc/kcore during my tests, but never completed the dump, but filled the partition. Tested with CentOS, Ubuntu and RHEL VMs.

Of all the tools I looked at as replacement, AVML proved to be the easiest to use. Compiled as described, on an Ubuntu 18.04.5 LTS VM. The binary should run on many systems and kernel versions. https://github.com/microsoft/avml#building-on-ubuntu https://github.com/microsoft/avml#tested-distributions

mczap commented 3 years ago

Thank you for your quick reaction and open-mindedness towards my suggestions. I have changed the readme.md as you recommended it and deleted the superfluous one under ./nix/tools-nix/mem/. Now I have to find out how to set the execution bit via git and your script will be even easier to use. Thanks for your development work

mczap commented 3 years ago

I have done all the needed changes, is it OK for you to merge it, or would you like further changes?

mczap commented 3 years ago

On RHEL7 there are still problems with archiving after the collection. In the script there is also a reference to the aff4 file, witch I missed. Please don't merge yet. I try to solve these points first.

diogo-fernan commented 3 years ago

Cool, thanks for contributing! Merging now.