volatility-memory-forensics

Volatility Memory Forensics (RAM Analysis)

When to Use

• Following a critical incident where a machine is isolated, and a RAM dump (.dmp, .raw, .vmem) is acquired before shutdown.
• When hunting for Fileless Malware, Advanced Persistent Threats (APTs), or In-Memory execution (e.g., Cobalt Strike Beacons, Meterpreter).
• To recover decrypted passwords, registry keys, or historical command lines that were stored in RAM and never written to disk.
• When analyzing systems suspected of harboring Kernel-level Rootkits.

Prerequisites

• Memory dump or forensic image acquired from the compromised system
• Volatility 2/3 framework installed with appropriate OS profiles
• Chain of custody documentation maintained for legal admissibility
• Understanding of the target OS memory management and process architecture

Workflow

Phase 1: Environment Setup and Profile Identification

# Concept: Volatility 3 (Python 3) doesn't require "profiles" like Volatility 2,
# it automatically downloads symbol tables based on the OS kernel structure.

# Ensure Volatility 3 is updated
python3 vol.py -h

# 1. Identify the Operating System and Architecture of the Memory Dump
python3 vol.py -f suspicious_machine.raw windows.info

# Output will confirm if it is Windows 10, Windows 7, Linux, etc., and list
# crucial kernel pointers (KDBG, PsActiveProcessHead) needed for deep analysis.

Phase 2: Process Enumeration & Anomaly Hunting

# Concept: We need to see what programs were running. Malware often
# pretends to be legitimate Windows processes (e.g., svchost.exe) or hides entirely.

# 1. List all active processes (equivalent to Task Manager)
python3 vol.py -f suspicious_machine.raw windows.pslist

# 2. Find hidden processes (Rootkits unlinking from the active process list)
# Compare pslist (standard linked list) vs psscan (carving memory for process headers).
# If a process appears in psscan but NOT pslist -> IT IS HIDDEN / MALICIOUS.
python3 vol.py -f suspicious_machine.raw windows.psscan

# 3. View the Process Tree (Parent/Child relationships)
# Anomalies: `cmd.exe` spawning from `explorer.exe` is normal.
# `cmd.exe` spawning from `services.exe` or `spoolsv.exe` is highly suspicious.
# `svchost.exe` spawning from anything other than `services.exe` is malicious.
python3 vol.py -f suspicious_machine.raw windows.pstree

# 4. View detailed command-line arguments passed to running processes
# e.g., finding `powershell -enc JABzAD0ATgBlAHcALQBPAGIAagBl...`
python3 vol.py -f suspicious_machine.raw windows.cmdline