DD

         To gain a full memory dump, we can use dd (standing for "data description"). DD is often hard to use. It took quite a bit of playing with to get it work for us during an analysis we had done recently. Download the dd program here: http://www.gmgsystemsinc.com/fau/. The command to use is "dd.exe if=\\.\physicalmemory of=[full path of where to write file].dd bs=4096". The if statement tells dd to dump the physical memory. of is the path of where that dump should go. For example z:\[filename].dd. And bs=4096 lets us copy large amounts of data faster and more stable.

Persomal Remarks: DD is by far a great tool to use to get a full image of a disk. I am personally not impressed with it's memory acquistion. It's a farily finicky program and can take a couple of runs to get it to go write. The positive of it is that it doesn't leave a large fingerprint when it's on a machine and capturing the memory, as opposed to FTK Imager.

UserDump

       UserDump is a microsoft tool that is able to generate a user dump of a process. The tool can be downloaded from http://support.microsoft.com/kb/241215. Support is also found on the same page.
To use userdump, we can run the following command "userdump [process id] Z:\[filename].dmp". The pre-requist for using this program is setting up a network drive from the victim machine to the forensics workstation we are using. To set up a shared drive, we can use "net use Z: \\[ip of forensics machine]\[folder name]".

To validate the dump files that we have created we will use a program named dumpchk.exe. A download link is found at: http://technet.microsoft.com/en-us/library/ee424340(v=ws.10).aspx. To use dumpchk, we run "dumpchk [name of file].dmp". This will display validation information about the dump file such as what product was used for the process (windows xp, nt, etc), and the modules that were ran.

Because these dump files can be fairly large, we can use a program from the PSTool Suite that will allow us to easily find strings. The program is coincidentally named Strings. To use we just run "strings [dump file].dmp".

Personal Remarks: Memory is always volitaile and a bit of a pandora's box when you are trying to capture it. Some of the time, capturing the memory of a process caused that process to crash. UserDump is a farily safe way to not mess with the entire memory and instead only grab a single process, which is far less space than the entire memory of a machine. These .dmp files, I've found, contain a LOT of spaghetti. That's where Strings comes in, since it can search that whole .dmp file and find a certain phrase or key input. These could be commands ran, or how the program was exectuted.

PSTools Suite

69 Tools are rolled together into the Sysinternals Suite. The PSTools Suite is also included in the suite and can be downloaded here: http://technet.microsoft.com/en-us/sysinternals/bb842062.
I will highlight only a few of the tools that I have used.

PSLoggedOn - running just "PSLoggedOn" will display the users that are currently logged onto a system. It will also display their access rights, ie whether they are administrator or not.

PSList - running "pslist" will display the currently running processes. This can display any odd programs that could be used as a backdoor by a hacker.

PSService - this will display a list of services that are currently being ran. "psservice" with no flags will give a list of those services. This list can sometimes be fairly lengthy.

PSFile - this will display a list of all the open files. This is useful to examine any odd files that could be running.

PSInfo - This displays information about the machine we are currently on. Various flags can display different information. For example -h will show installed hotfixes, -s will show installed applications, and -d will show disk volume information. For a complete list of all the flags see http://technet.microsoft.com/en-us/sysinternals/bb897550.aspx.

Personal Remarks: There are a lot more tools listed with PSTools Suite, but I haven't ever touched them. The most common of these tools is just to run pslist. This shows all the running processes that you can then review and flag any as suspicious. All of these programs are ran with no flags attached to them. NetCat-ing them to a forensics machine is the best practice for these tools.

NbtStat

Nbtstat (standing for NetBios Over TCP/IP Statistics) is a CLT that displays the cached NetBios name table. We can use it to display NetBios adapter status, the name-to-IP address mappings, names that have been registered locally on a system by NetBios applications, and even displays names resolved by broadcasts and by querying WINS servers. For more information see: http://technet.microsoft.com/en-us/library/cc940106.aspx.
How it works: To display the NetBios name cache, we can use the command "nbtstat -c".

Personal Remarks: For all of the labs that we completed, there were no NetBios names in the cache. I can see where this could be benefical if an attacker had accessed a computer and that registered in the NetBios and they no longer had an active connection. Of course, I never ran across this, so I can't really speak to the validity of this.
In addition to the -c swtich, there is the -A switch that lets you pass in a single ip address to check. It looks like the could be benefical. The -a swtich shows the status of the NetBios adapter.

FPort

FPort (made by McAffe) is another CLT that can display open ports with executables linked to them. It can easily display programs that opened ports and the protocol that it is using. The lastest version is v2.0 and can be downloaded here: http://www.mcafee.com/us/downloads/free-tools/fport.aspx.
How it works: using the command line, just typing "FPort" will run the program to display all the ports with excutables linked to them.

Personal remarks: This tool can be difficult to find, but easy to use. The link above is the correct link to use. I made the mistake of downloading from some where third party site. Pretty sure it was virus infected. Oh well, everyone can use a bit more spyware.
The output of FPort displays all the open ports and what applications are linked to them. This is handy to see if there is a certain program that is leaking data. Using this tool with wireshark is helpful if there is a open port found with an application linked to it.

NetStat

NetStat is a CLT (command line tool) that displays a network connections, routing tables, and network interfaces. It is built into both Unix/Unix-Like, and Windows machines.
How it works: using "netstat -an" will display all the active connections on a machine.
"Netstat -rn" can be used to display the routing table.

Personal remarks: The information given from this tool can be extremely helpful, especially in network analysis for active connections. On almost every lab used, "netstat -an" was used. Once a connection is seen that is foreign, Wireshark can be used to capture traffic being sent to that address or from that address.

NetStat example output
http://indonetworksecurity.com

NetCat

       Netcat is a TelNet client that can be used to send information from one machine to another. It's commonly called the 'swiss army knife' due to it's functionality and common use with forensic investigators.

How it works: a listener needs to be established on the machine that you wish to pass data to. This is accomplished with the command "netcat -v -l -p 2222 > [filename].txt". The -v puts netcat into verbose mode, which will display status messages. The -l is the listening switch. Finally, -p is to secifiy the port to listen on. The ending portion after the greater-than sign is the output file.
To then send a command from a machine to the listener, you'll run: "[some command] | netcat [ip of listener] [port number]". The [ip of listener] is the ip address of where the netcat listener is.
Overall, netcat is a easy and quick way to send information from one machine to another.

Where to download: The version of netcat that I enjoy and have found to work the best is the beta version from nmap. Download can be found here: http://nmap.org/ncat/.

Personal remarks: Netcat is a fairly easy to use tool that can transfer files and information between computers quickly. That is, if you get it set up right. Initally using netcat, it took a number of failed attempts to finally realize the format of commands. Then even more failed attempts to realize that the firewall was blocking the port we were sending info through. After those user 'blunders' the tool is extremely easy to use and pretty efficent.