Capture memory before you lose it

short · 45 min · Objective 4.8

Task

Put something in memory that exists nowhere on disk, then demonstrate the order of volatility by capturing it — and by losing it. This is why 'do not power off' is the first instruction a first responder is given.

Steps

  1. Write /tmp/holder.py: a script that reads a marker string, holds it in a variable, deletes the source file, and then sleeps. Run it in the background and note its PID.
  2. Confirm the marker is genuinely not on disk any more: search the filesystem for it and find nothing.
  3. Now capture the process memory: sudo gcore <pid>, or read /proc/<pid>/maps and dump the writable regions.
  4. Search the capture for the marker and find it. This is evidence that exists in exactly one place.
  5. Record the order of volatility in /tmp/volatility.md, from registers down to archival media, and mark where your marker sat.
  6. Now destroy it the way a well-meaning responder does: kill the process, or reboot the VM. Search again and confirm the evidence is unrecoverable.

Verify

sudo grep -rc "LABMARKER" / --exclude-dir=/proc --exclude-dir=/sys 2>/dev/null | awk -F: '{s+=$2} END {print s+0" on-disk occurrence(s)"}'
grep -c "LABMARKER" /tmp/core.* 2>/dev/null
python3 - <<'PY'
import glob
cores=glob.glob('/tmp/core.*')
assert cores, 'no memory capture was taken'
found=any(b'LABMARKER' in open(c,'rb').read() for c in cores)
print('marker recovered from memory capture:',found)
assert found, 'the marker was not in the capture - check the process was still running'
PY
grep -ciE "registers|ram|disk|archival" /tmp/volatility.md

The first must be 0 — the marker is nowhere on disk. The assertion must find it in the memory capture. That pair is the demonstration: a piece of evidence that exists only in RAM, and that a reboot removes permanently.

Notes

Fileless malware, injected code, attacker shell sessions and decryption keys all live exactly where your marker did. Pulling the plug on a compromised machine destroys all of it, which is why the instruction is to isolate the host from the network and capture memory while it is still running.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.