[Vol-users] Reliable Memory Acquisition for Windows, Linux, macOS

As members of the Volatility mailing list, you know that memory acquisition has proven to be one of the most important and precarious aspects of digital investigations. Over the years, you have seen the Volatility team spend a lot of time troubleshooting issues that were ultimately caused by failed or corrupted acquisition attempts. You have also seen our colleague, George M. Garner, lead spirited debates about the reliability of proposed acquisition tools and techniques. With George’s untimely passing last summer, the industry not only lost one of the most robust Window’s acquisition tools, but it also lost an industry thought leader who held the forensics community to a higher standard. Unfortunately, many investigators still blindly trust free and commercial acquisition tools without understanding the associated risks and limitations. While these tools may be readily accessible, many are unsupported or have been effectively abandoned by their original developers who have moved on to pursue other projects. As an example, Google’s GRR project recently disabled their memory forensics capabilities because it was introducing instabilities, and it wasn’t being actively maintained. A recent empirical study also showed that most open source or commercial Windows memory acquisition tools either failed to collect or crashed systems with modern security features enabled. We can also share countless stories of investigators and law enforcement officers returning to their labs only to discover that their memory acquisitions had failed. There is a growing need for a reliable and actively supported memory acquisition capability across Windows, Linux, and macOS. If you follow us on twitter (@volatility) or have taken our training classes within the last couple of years, you have heard about Volexity’s Surge Collect. Surge Collect provides a reliable and commercially supported collection capability with flexible storage options. Surge Collect can also be easily integrated with Tanium, Carbon Black, and other enterprise software agents. It is currently in use by many of the largest federal and local law enforcement agencies around the world. Surge Collect is also actively used by leading incident response firms, technology companies, telecommunication providers, universities, Fortune companies, and branches of the military. If you are looking for a commercially supported acquisition solution with dedicated development and support teams for Windows, Linux, and macOS, I recommend you check out Volexity’s Surge Collect. Hopefully, this will FINALLY give investigators a reliable and flexible acquisition capability they can depend on and allow the Volatility team to focus more of our time on developing exciting new memory analysis capabilities! Thanks, AAron Walters Original author of Volatility Founder of The Volatility Foundation