Zero Condition Toolkit: Memory Forensics Capability

ZCT is a volatile memory forensics capability. In Phase I, Pikewerks implemented cross view detection to identify both known and unknown kernel rootkits; and other activity attempting to subvert the normal operations of the operating system. In Phase II Pikewerks proposes to 1) expand collection of memory to include full RAM hibernation storage and RDMA/DMA, 2) expand characterization and analysis, and 3) dramatically improve the user interface. The proposed development will be primarily focused on creating a core ZCT capability, with three unique interfaces and plug-ins for specific customer basis. ZCT Red is similar in concept to the existing Phase I capability. Its purpose is to provide an interactive framework for forensics collection, reverse engineering, and debugging. ZCT Live is a stealthier, lighter weight version that does not support debugging, but instead integrates networked communication and analysis across nodes into the design. ZCT Recovery is a service that can allow a user to quickly recover from malware by cleaning static snapshots of memory to pristine, uninfected versions. All three variations are powered by a single core engine which is described in the accompanying proposal.