Memory forensics is the discipline of examining volatile memory (RAM) to find evidence that disk-only forensics miss. Credentials cached in memory, in-memory malware, injected code, encrypted traffic plaintext — all live only in RAM. This module covers the tooling and workflow.
Why memory forensics
Traditional disk forensics recovers files, logs, persistence. Memory adds:
- Process list at incident time (including hidden processes)
- Loaded DLLs / injected code
- Open network connections (past + present)
- Recently-used credentials (LSASS-style secrets, SSH keys, passphrases)
- Decrypted plaintext of TLS / VPN traffic (if session was active)
- Malware that never touches disk (fileless)
- Command history from memory-resident shells
Acquisition — getting RAM out
Windows
- DumpIt — single-binary full-memory dumper
- WinPmem — open-source, reliable
- Microsoft LiveKD / kd — for kernel debugging scenarios
- Hibernation file — hiberfil.sys contains compressed RAM dump
- Crash dump — MEMORY.DMP from kernel crashes
Linux
- LiME (Linux Memory Extractor) — kernel module for RAM acquisition
- /dev/mem — on older kernels (restricted in modern)
- /proc/kcore — kernel memory image
- AVML (Azure-developed) — modern portable acquisition tool
Cloud / EC2
- AWS SSM Run Command — run DumpIt/LiME/AVML remotely without console access
- AWS EC2 GetConsoleScreenshot — NOT memory, but visible console
- Live snapshot of EBS — disk only, not memory. Memory requires running tool inside the instance
Analysis — Volatility3
Volatility is the de facto open-source memory analysis framework. Version 3 is the current actively-maintained branch.
← Previous · Module 5
Module 5 · Privilege Escalation Defence <span style="color:#6EC1E4;font-size:0.7em;vertical-align:middle;" title="Academy lesson — sign in for full access">🔒</span>
Next · Module 7 →
Module 7 · Threat Hunting Workflow <span style="color:#6EC1E4;font-size:0.7em;vertical-align:middle;" title="Academy lesson — sign in for full access">🔒</span>
Other modules in this track
Module 1 · Beginner
Module 1 · Linux Hardening Fundamentals <span style="color:#6EC1E4;font-size:0.7em;vertical-align:middle;" title="Academy lesson — sign in for full access">🔒</span>
Apr 19, 2026 · 4 minModule 8 · Intermediate
Module 8 · Incident Response Playbook <span style="color:#6EC1E4;font-size:0.7em;vertical-align:middle;" title="Academy lesson — sign in for full access">🔒</span>
Apr 19, 2026 · 4 minModule 2 · Beginner