RAM Analysis System, or simply RAMAS, is an extensible carving utility which aims to ease and automate the process of analysing communication records left behind in physical memory by instant-messaging and email web clients. We have developed a forensic framework where the responsibility of creating and updating carving modules for different applications is distributed amongst practitioners. RAMAS also provides a way to inspect results, either by the inspection of forensic timelines or by making available a database which can be queried to unveil sophisticated correlations among the recovered evidence.
RAMAS is able to extract communication records from several web-applications, such as:
- Facebook (and Messenger.com) Chat
- Twitter Direct Messages
- Skype Web Clients
- Roundcube Email Client
- Outlook Email Client
First off, to setup RAMAS you need to clone the repository and, at the root of the repository, perform the following command:
$ pip install -r requirements.txt
This installs all the dependencies of RAMAS automatically. This may require root access, in this case perform the same command with the sudo prefix:
$ sudo pip install -r requirements.txt
To extract data using RAMAS, change directory to csf/ and execute the tool:
$ python ramas.py
RAMAS takes as input strings files, obtained from the processing of raw memory images. Strings files can be obtained by running the strings utility over raw dumps.
A simple example is depicted below.
$ strings RAW_DUMP_FILE > STRINGS_DUMP_FILE
To generate python documentation in this project you must run the following command whilst in the root of the project:
$ python setup.py docs
The Sphinx documentation will then be available at docs/_build/html.
@tiagolb @dmbb @magicknot
This tool was initially developed for Forensic Cyber Security course at IST (https://tecnico.ulisboa.pt) under the open-source MIT License (https://opensource.org/licenses/MIT). Likewise, the improved RAMAS v2.0 was developed in the scope of the Research Topics course at IST.
This tool was tested in a 64-bit Ubuntu 16.04 LTS with python 2.7.12.
This tool uses the HTML.py module for html generation (http://www.decalage.info/python/html)
This project has been set up using PyScaffold 2.4.2. For details and usage information on PyScaffold see http://pyscaffold.readthedocs.org/.