Paper Info
Title
Memory forensics and the Windows Subsystem for Linux.
Abstract
The Windows Subsystem for Linux (WSL) was first included in the Anniversary Update of Microsoft's Windows 10 operating system and supports execution of native Linux applications within the host operating system. This integrated support of Linux executables in a Windows environment presents challenges to existing memory forensics frameworks, such as Volatility, that are designed to only support one operating system type per analysis task (e.g., execution of a single framework plugin). WSL breaks this analysis model as Linux forensic artifacts, such as ELF executables, are active in a sample of physical memory from a system running Windows. Furthermore, WSL integrates Linux-specific data structures into existing Windows data structures, such as those used to track per-process metadata as well as userland runtime data. This integration results in existing analysis plugins producing inconsistent results when analyzing native Windows processes compared to WSL processes. Further complicating this situation is the fact that much of the WSL subsystem internals are completely undocumented. To remedy the current deficiencies related to WSL analysis, a research effort was undertaken to understand which existing Volatility plugins are affected by the introduction of WSL as well as what updates are necessary to fully support memory forensics of WSL. This paper describes these efforts, including our study of the operating systems data structures relevant to WSL as well as the development of new Volatility analysis plugins.
Year
DOI
Venue
2018
10.1016/j.diin.2018.04.018
Digital Investigation
Keywords
Field
DocType
Memory forensics,Computer forensics,Memory analysis,Windows 10,Linux,WSL
Data structure,Metadata,Memory forensics,Computer security,Computer science,Plug-in,Operating system,Executable
Journal
Volume
Issue
ISSN
26
SUPnan
1742-2876
Citations 
PageRank 
References 
2
0.46
2
Authors
4
Name
Order
Citations
PageRank
Nathan Lewis130.83
Andrew Case213811.36
Aisha I. Ali-Gombe332.19
Golden G. Richard III422.15