Download Memory Forensics over the IEEE 1394 Interface

The IEEE 1394 “FireWire” interface provides a means for acquiring direct memory access. We discuss how this can be used to perform live memory forensics on a target system. We also present libforensic1394 an open-source software library designed especially for this purpose. Passive and active applications of live memory forensics are analysed. Memory imaging techniques are discussed at length. It is demonstrated how the interface can be used both to dump the memory of a live system and to compromise contemporary operating systems.