Memory Forensics

Analyze memory dumps:

• Process enumeration
• Hidden process detection
• DLL analysis
• Code injection detection
• Network connections
• Credential extraction
• Registry artifacts
• Timeline generation

Required Context

1. Dump File: Path to memory dump
2. Focus: Injection, credentials, network, all
3. OS: Windows/Linux (auto-detect)

Tools Used

Volatility 3, strings

Example

/memory
Dump: /forensics/memory.dmp
Focus: Injection detection, credentials