Memory Forensics
RAM holds what the disk never sees. Dump it, then hunt the rogue process inside.
What you will learn
- -Explain why RAM holds evidence that never touches disk
- -Acquire and analyze a memory image with Volatility
- -Spot a rogue or hidden process from a memory dump
Modern tries hard to never touch the disk. It runs entirely in memory, injects into a legitimate process, and leaves your carefully imaged drive looking clean. If you skipped the RAM capture, you never saw it. That is why memory forensics is not optional on any live .
Why RAM is the crime scene
Everything a running program does passes through memory. Decryption keys, typed into a browser, the command a piece of malware just received from its , connections that are open right now, and processes that have unlinked themselves to hide. None of that is guaranteed to hit disk, and some of it never will.
RAM is also volatile in the literal sense. Cut power and it is gone in seconds. So you acquire it first, on the live machine, using a tool that dumps physical memory to a file: avml on Linux, WinPmem or FTK Imager on Windows.
$sudo avml memory.rawVolatility reads the dump
A raw memory image is just a flat blob of bytes with no structure you can browse. Volatility is the that parses it, walking kernel data structures to reconstruct the list of processes, open , loaded modules, and command lines that were live at capture time.
Volatility 3 auto-detects the OS from the dump, so you point it at the file and ask for what you want with a plugin name.
$vol -f memory.raw windows.pslist$vol -f memory.raw windows.pstree$vol -f memory.raw windows.netscanStart with pstree. Parent-child relationships expose things a flat list hides. A cmd.exe whose parent is a Word document (winword.exe) is a macro that spawned a , which is a textbook phishing . Processes are supposed to have sane lineage, and the ones that do not are your leads.
Finding the rogue process
A hidden process is the classic hunt. unlink themselves from the list the OS reports, so pslist (which walks that linked list) misses them. psscan ignores the list and carves process structures directly out of memory, so it finds the ones that tried to vanish. Diff the two and anything in psscan but not pslist is actively hiding.
$vol -f memory.raw windows.psscan$vol -f memory.raw windows.malfind$vol -f memory.raw windows.cmdlinemalfind is the shortcut. It scans for memory pages that are executable, writable, and not backed by a file on disk, which is exactly what injected looks like. It hands you a shortlist of suspects and a hex dump of what is running in each, often with the MZ of a PE file sitting in memory where no file should be.
A captures live in the clear: session , passwords, , whatever was in use. Acquire and analyze RAM only on systems you own or are authorized in writing to examine, and store the dump with the same custody as any other evidence.
A rootkit unlinked its process from the kernel's process list. Which Volatility approach still finds it?
In a pstree, you see cmd.exe with parent winword.exe. In one line, why is that suspicious?
Legitimate documents do not open shells. A .exe child of winword.exe is the of a macro-based phishing payload executing on open.