What it is
Memory forensics is the practice of analyzing a computer’s RAM to see what is happening right now or just happened. By capturing and examining memory, investigators can spot active processes, network connections, passwords in use, and stealthy malware that may never touch the disk.
Why it matters
Many modern threats hide in memory to dodge file scans. Looking at RAM lets you catch live attacks, rebuild timelines, and confirm exactly what ran, even if the attacker tried to clean up.
What you can find - quick tour
-
Running processes and threads that don’t appear in Task Manager
-
Network sockets and connections tied to suspicious programs
-
Loaded modules and drivers that reveal rootkits or injectors
-
Credentials, keys, and commands left in memory by tools and scripts
If you need to run it - basics
-
Isolate the system and avoid heavy use that overwrites memory.
-
Capture RAM with a trusted tool and preserve hashes for integrity.
-
Analyze with Volatility/Velociraptor or similar frameworks.
-
Correlate with logs, EDR, and disk artifacts to confirm scope.
Tips
-
Practice on test hosts so you can work fast under pressure.
-
Prefer cold captures when possible; document every step.
-
Automate extraction of IoCs and feed them to SIEM and EDR blocklists.
Preserve memory before it changes
Capture volatile memory before shutdown when the response plan and legal authority permit it. Record the tool, time, system clock, hash, operator, and storage location so the image can be verified later. Analyze processes, injected regions, loaded modules, sockets, command history, and credentials with context from disk and network logs. A memory image can contain passwords and personal data, so encrypt it and restrict access. Use a copy for analysis, keep the original unchanged, and validate suspicious behavior in an isolated malware-analysis environment rather than on the source workstation.