Analyze System Memory for Security Incidents

A memory-forensics reference for acquiring, analyzing, and extracting artifacts from RAM dumps for incident response and malware analysis, built around the Volatility 3 framework. Acquisition tools are covered per platform: WinPmem or DumpIt for Windows, LiME as a loadable kernel module or /proc/kcore for Linux, osxpmem for macOS, plus extracting memory directly from VMware .vmem files, VirtualBox's dumpvmcore, or QEMU/virsh dump. Volatility usage spans process analysis (pslist, pstree, hidden-process detection via psscan, per-process memory dumps via memmap, environment variables, command lines), network analysis (netscan, netstat), DLL and module analysis (dlllist, ldrmodules for hidden or injected DLLs, kernel modules), memory injection detection (malfind, VAD and vadinfo analysis, YARA scanning of suspicious regions), registry analysis (hivelist, printkey, hivescan), and filesystem artifact recovery (filescan, dumpfiles, MFT analysis), plus equivalent Linux (pslist, bash history via linux.bash, sockstat, lsmod) and macOS plugin sets. It documents two named workflows end to end: a malware-analysis sequence (process survey, network connections, malfind, per-process DLL and handle inspection, executable dumping, string extraction, YARA scanning) and an incident-response sequence (event timeline via windows.timeliner, user activity, persistence-mechanism checks in the Run registry key, service and scheduled-task enumeration, recent-file scanning). It explains the underlying Windows data structures analysts reason about - EPROCESS with its ActiveProcessLinks list and PEB pointer, and the PEB itself with ImageBaseAddress, Ldr for the DLL list, and the BeingDebugged anti-debug flag - and the VAD structure with its page-protection flags, where PAGE_EXECUTE_READWRITE is a classic injection indicator. Detection patterns cover four named process-injection techniques (classic DLL injection via VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread, process hollowing, APC injection, and thread execution hijacking), rootkit detection by diffing pslist against psscan output to surface hidden processes, DKOM detection via windows.callbacks, and SSDT-hook detection. Credential-extraction plugins (hashdump, lsadump, cachedump) and YARA integration (writing rules with shellcode-pattern strings, scanning process or kernel memory) round out the toolkit, alongside string extraction via strings and FLOSS for de-obfuscating packed or encoded strings.

Use during incident response or malware analysis when a memory dump needs to be acquired and examined for running processes, network connections, injected code, persistence mechanisms, or credentials. Not for disk or network forensics on their own - this is specifically the memory-analysis layer, meant to be correlated with disk and network findings rather than used in isolation. Requires proper chain-of-custody handling; this is a defensive and investigative skill, not a technique for building malware.

Input is a raw memory image (.raw, .lime, .elf, or a VM's native memory file) plus, for Windows analysis, the matching OS symbol table. Output is process, network, module, registry, and filesystem artifact listings, injection and rootkit detection results, extracted credentials, and YARA scan hits, typically captured to text or CSV files for correlation and reporting.

### Install Volatility 3
pip install volatility3

### Basic usage
vol -f memory.raw <plugin>

### With symbol path
vol -f memory.raw -s /path/to/symbols windows.pslist

Built on Volatility 3, with YARA for signature scanning, FLOSS for obfuscated-string extraction, and platform acquisition tools (WinPmem, LiME, osxpmem) feeding it raw memory images from Windows, Linux, macOS, and major hypervisors including VMware, VirtualBox, QEMU, and Hyper-V.

Incident responders, DFIR analysts, and malware analysts who need the exact Volatility plugin, acquisition command, or detection pattern for a given artifact - hidden processes, injected code, persistence, credentials - rather than reconstructing the toolchain from documentation each time.