Hello and welcome to the Thursday, October 30th, 2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the sands.edu graduate certificate program in

cybersecurity engineering. In diaries today, we have Jim talk about memory-only file systems on Linux.

Sometimes colloquially called RAM disks. Of course, they exist on other operating systems as well.

The tricky thing about these memory-only file systems on Linux is that there is no

block device associated with those file systems.

Often, DeafSHM is a typical location.

Sometimes they have also temporary files systems, even slash temp,

sometimes being mounted

as a memory-only file system.

The problem now is that DD,

your standard tool that you're using

to make sort of no forensically sound copies

of data and similar tools

don't work on these memory-only file systems.

So Jim is going over a little shell script that he's using

in order to deal with those file systems.

Yes, it's not ideal in the sense that it doesn't sort of create a bit by bit copy of the file system,

but instead what Jim is suggesting here is to basically just first use the shell stat command

in order to collect basic statistics about the files,

and then copy individual files.

...