Chapter 1 — Why Memory Forensics?
Disk forensics misses everything that is running: decrypted malware payloads, injected shellcode, in-memory credentials, active network connections, and processes that hide from the filesystem. Memory forensics catches attackers in the act — and volatile evidence disappears the moment the machine reboots.
Chapter 2 — Memory Acquisition
# Windows — WinPmem
winpmem_mini.exe memory.raw
# Windows — DumpIt
DumpIt.exe /O memory.dmp
# Linux — LiME (Loadable Kernel Module)
insmod lime.ko "path=/tmp/memory.lime format=lime"
# VM snapshot — VMware: suspend VM, then use .vmem file in VM directoryChapter 3 — Volatility 3 Framework
# Install
pip3 install volatility3
# Identify OS
vol -f memory.raw windows.info
# Plugin usage pattern
vol -f memory.raw PLUGIN [options]Chapter 4 — Process Analysis
# List all processes
vol -f mem.raw windows.pslist
vol -f mem.raw windows.pstree # parent-child view
# Find hidden processes (rootkit detection)
vol -f mem.raw windows.psscan # scans physical memory for EPROCESS structs
# Dump process executable
vol -f mem.raw windows.dumpfiles --pid 1234
# Check command line args
vol -f mem.raw windows.cmdlineChapter 5 — Network Connections
# Active and recently closed connections
vol -f mem.raw windows.netstat
vol -f mem.raw windows.netscan
# Look for: unusual outbound connections, beaconing patterns, non-standard portsChapter 6 — Detecting Code Injection
# Find injected code (VAD anomalies)
vol -f mem.raw windows.malfind
# Malfind looks for: RWX memory regions, PE headers in unexpected places
# Dump suspicious region
vol -f mem.raw windows.malfind --dumpChapter 7 — Rootkits & Anti-Forensics
Rootkits hide processes by unlinking EPROCESS from the ActiveProcessLinks list — pslist misses them but psscan finds them by scanning raw memory. DKOM (Direct Kernel Object Manipulation) is the most common technique.
# Compare pslist vs psscan — discrepancy = hidden process
vol -f mem.raw windows.pslist > pslist.txt
vol -f mem.raw windows.psscan > psscan.txt
diff pslist.txt psscan.txtChapter 8 — Malware Analysis in Memory
# Extract strings from a suspicious process
vol -f mem.raw windows.strings --pid 4512
# Check loaded DLLs
vol -f mem.raw windows.dlllist --pid 4512
# Extract registry hives loaded in memory
vol -f mem.raw windows.registry.hivelist
vol -f mem.raw windows.registry.printkey --key "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"Workbook complete! You've covered all chapters. Mark it complete below and continue your learning path.