AfterLife permits the collection of physical memory contents from a system after a warm or cold reboot. The tool is an extension of the msramdump utility by Wesley McGrew to add forensic features and some functionality. In addition to providing a self-contained memory acquisition environment on a USB drive or a CD/USB combination, AfterLife is also bundled with a suite of tools to help test recoverability of memory from different hardware platforms. In testing at CERT, successful memory recovery varied widely depending on the brand and configuration of computer systems.

AfterLife Version 01 provides an absolute last-resort method to attempt to recover memory contents from a system for which no other mechanism to collect physical memory exists. The tool suite also facilitates testing of memory recovery potential on specific hardware configurations, which better informs the decision to employ AfterLife in a specific scenario. An example use-case would be to recover cryptographic material stored in memory on a system that employs full-disk encryption.

Availability

Public

Release Date

January 2010

System Requirements

AfterLife creates its own environment for execution and requires appropriate USB or CD/USB media and an appropriate target system.

Download

Please visit the SourceForge website to download AfterLife.