Memory Forensics Introduction

Memory forensics examines the contents of computer RAM to discover evidence of malicious activity. Unlike disk forensics, memory analysis reveals running processes, network connections, and injected code that may never persist to storage.

Why Memory Matters

Modern attacks often operate entirely in memory. Fileless malware, living-off-the-land techniques, and memory-resident implants leave minimal disk artifacts. Without memory analysis, these threats remain invisible.

Memory also captures temporal state—what was running at acquisition time. Disk analysis shows what exists, but memory shows what was active. Process command lines, network connections, encryption keys, and decrypted data all exist in memory when the system runs.

Memory Acquisition

Live acquisition captures memory from running systems. Tools like WinPmem, DumpIt, or Magnet RAM capture raw memory images. Speed matters—the longer the system runs, the more memory changes.

Cold boot acquisition exploits memory persistence. RAM contents survive briefly after power loss. Specialized techniques can recover data even from powered-off systems.

Virtual machine snapshots provide memory images of VMs. Hypervisor-level acquisition avoids many anti-forensics techniques that detect acquisition tools.

Acquisition Considerations

Footprint matters. Acquisition tools modify memory by loading and executing. Minimize footprint by using small, portable tools rather than installing investigation suites on the target.

Document everything. Record acquisition time, tool used, target system state, and hash of the resulting image. This documentation supports evidence integrity.

Prioritize acquisition. Memory is volatile—acquire it before disk imaging or other investigation steps that might modify system state.

Volatile Artifacts

Valuable memory artifacts include:

• Process list - Running processes and their command lines


• Network connections - Active and recent connections


• Loaded DLLs - Libraries loaded by processes


• Registry hives - In-memory copies of registry data


• Open files - Handles to files, including deleted ones


• Decrypted data - Content that exists decrypted only in RAM


• Injected code - Malicious code injected into legitimate processes


• Strings and passwords - Credentials and other sensitive data

Memory analysis addresses questions disk analysis cannot: What was executing? What connections were active? What data was being processed?