Memory Forensics

Memory Forensics

Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.

When to Use This Skill

• Performing memory analysis during incident response or breach investigation
• Extracting malware artifacts (processes, injected code, network connections) from a RAM capture
• Acquiring volatile memory from a live Windows/Linux/macOS system before shutdown
• Using Volatility 3 / Rekall to triage memory dumps
• Recovering credentials, browser sessions, or open files from process memory

Memory Acquisition

Live Acquisition Tools

Windows

# WinPmem (Recommended)
winpmem_mini_x64.exe memory.raw

# DumpIt
DumpIt.exe

# Belkasoft RAM Capturer
# GUI-based, outputs raw format

# Magnet RAM Capture
# GUI-based, outputs raw format

Linux

# LiME (Linux Memory Extractor)
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

# /dev/mem (limited, requires permissions)
sudo dd if=/dev/mem of=memory.raw bs=1M

# /proc/kcore (ELF format)
sudo cp /proc/kcore memory.elf

macOS

# osxpmem
sudo ./osxpmem -o memory.raw

# MacQuisition (commercial)