memory-forensics

Memory Forensics

Volatility framework reference, process analysis, memory artifact types, and RAM analysis patterns for incident response.

Knowledge Base

Why Memory Forensics

Memory forensics reveals evidence that does not exist on disk:

• Running malware: Fileless malware executes entirely in memory. No disk artifact exists.
• Injected code: Malware injected into legitimate processes leaves memory artifacts but may not be visible on disk.
• Decrypted data: Encrypted files are decrypted in memory when accessed. Memory captures may contain plaintext of encrypted data.
• Network connections: Active and recently closed connections exist in kernel memory.
• Credentials: Password hashes, Kerberos tickets, and plaintext passwords reside in LSASS memory and other process spaces.
• Encryption keys: Full-disk encryption keys exist in memory while the volume is mounted.
• Rootkit artifacts: Kernel rootkits that hide from disk-based tools can be detected through memory analysis.
• Process history: Terminated processes may leave residual artifacts in memory until the pages are reused.

Memory Acquisition

Windows:

# WinPMem (Rekall project) -- most reliable
winpmem_mini_x64.exe output.raw

# DumpIt (Comae/Magnet) -- single-click
DumpIt.exe  # Outputs to current directory

# FTK Imager -- GUI-based, widely accepted in legal proceedings
# File > Capture Memory > Select output location

Linux:

# LiME (Linux Memory Extractor) -- kernel module
# Must be compiled for the target kernel version
insmod lime.ko "path=/evidence/memory.lime format=lime"

# /proc/kcore (requires root, may not capture all memory)
dd if=/proc/kcore of=/evidence/kcore.raw bs=1M

# AVML (Acquire Volatile Memory for Linux) -- Microsoft, no compilation needed
./avml /evidence/memory.lime

Verification:

# Always hash memory images immediately after acquisition
sha256sum memory.raw > memory.raw.sha256

Volatility 3 Architecture