AfterLife permits the collection of physical memory contents from a system after a warm or cold reboot. The tool is an extension of the msramdump utility by Wesley McGrew that adds forensic features and some functionality. In addition to providing a self-contained memory acquisition environment on a USB drive or a CD/USB combination, AfterLife is also bundled with a suite of tools to help test recoverability of memory from different hardware platforms. In testing at the CERT Division, successful memory recovery varied widely depending on the brand and configuration of computer systems.

AfterLife Version 01 provides an absolute last-resort method for attempting to recover memory contents from a system for which no other mechanism to collect physical memory exists. The tool suite also facilitates testing of memory recovery potential on specific hardware configurations, which better informs the decision to employ AfterLife in a specific scenario. An example use-case would be to recover cryptographic material stored in memory on a system that employs full-disk encryption.

Permanent link to this article: