Memory Forensics¶
Acquisition and analysis of volatile memory with Volatility 3. Memory answers what disk and logs can't — what was running, including fileless and injected code — but only for the instant it was captured, so it complements the timeline rather than replacing it.
Why memory¶
| Only memory reliably shows… | Because |
|---|---|
| Fileless / injected malware | Never touched disk — lives in a legit process's memory (injection) |
| Actual running processes incl. hidden ones | psscan/psxview beat a rootkit's unlinked list |
| What a process ran (full command line, decoded) | cmdline recovers encoded PowerShell, C2 URLs |
| Live network connections incl. closed/hidden | netscan carves them from RAM |
| Credentials in LSASS | NT hashes, Kerberos tickets, plaintext (credentials) |
| Disk-encryption keys | In RAM while the volume is unlocked — image before power-off |
| Kernel rootkit tampering | SSDT hooks, unlinked drivers — invisible to userland |
| Registry not yet flushed to disk | Values written moments before capture |
Question → page¶
| Question | Page |
|---|---|
| How do I run Volatility 3, which plugin for what? | Volatility 3 workflow |
| Is there injected / fileless / hollowed code? Which process is evil? | Processes & injection |
| What credentials were exposed? What was in the live registry? Is there a rootkit? | Credentials, registry & rootkits |
| How do I capture RAM in the first place? | Imaging & acquisition |
Pages¶
- Volatility 3 workflow — setup, symbols, the plugin-by-question order, reading the results
- Processes & injection — process-tree anomalies,
malfind, hollowing, injection tells - Credentials, registry & rootkits — hashdump/lsadump, live registry, encryption keys, kernel tampering
Where it sits in the investigation¶
flowchart LR
A[Acquire RAM<br/>before power-off] --> V[Volatility 3<br/>pstree → cmdline → malfind → netscan]
V --> D[Dump payload<br/>YARA / sandbox]
V --> X[Cross to disk & network]
X --> P[Prefetch/Amcache · Zeek · creds → lateral movement]Capture RAM first (it's the most volatile evidence and the only source for the items above), work the Volatility workflow, then pivot every finding back to disk artifacts (Windows), network (Zeek/Arkime), and the adversary techniques that produced it. If the box has an unlocked encrypted disk, the RAM image is also your only shot at the key.
Adding a page here
python new.py memory/<name> -t concept — it appears in the sidebar automatically.