I have a 16GB memory dump from Belkasoft RAM Capture, what free tools can I use to analyze it?

Question

I have a 16GB memory dump from Belkasoft RAM Capture, what free tools can I use to analyze it?

I have used IDA free version to try to open it and it is showing me an error that it is out of memory and asking me to increase system drive by 70GB.

Are there any free software tools which don't require such large disk space?

Answer 1

Tools the can be used to analyze these files include

• Belkasoft Evidence Cente can extract remnants of conversations and communications occurring in social networks, chat rooms, multi-player online games, Skype; data from cloud services such as Flickr, Dropbox, Sky Drive, Google Drive etc.; communications in Webmail systems such as Gmail, Hotmail, Yahoo; Web browser and virtual worlds artifacts, and so on
• Elcomsoft Forensic Disk Decryptor extracts decryption keys protecting encrypted volumes (PGP, True Crypt, BitLocker and Bitlocker To Go containers are supported), allowing investigators to instantly access the content of these encrypted volumes without brute-forcing the original volume password. All the keys from a memory dump are extracted at once, so if there is more than one crypto container in the system, there is no need to re-process the memory dump.
• Passware forensic toolkit including tools for capturing memory dumps via FireWire attack. Also includes a tool to extract decryption keys for popular crypto containters
• Memoryze can capture & analyze memory images (although not tested with belkasoft RAM capture images)
• Volatility For example tutorial refer to https://resources.infosecinstitute.com/topic/memory-forensics-and-analysis-using-volatility/
• Rekall Forensics
• WinDbg can analyze complete system memory dumps, although may need to develop a converter to properly load image created with belkasoft RAM capture.
• A hex editor designed for large files such as wxHexEditor