Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process hollowing, DLL injection, or hidden processes/rootkits. Use during incident response on a compromised or suspect system when disk-based forensics alone is insufficient and volatile evidence of malware or intrusion must be recovered from memory.
Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process hollowing, DLL injection, or hidden processes/rootkits. Use during incident response on a compromised or suspect system when disk-based forensics alone is insufficient and volatile evidence of malware or intrusion must be recovered from memory.
Appropriate symbol tables (ISF files) for the target OS version
Sufficient disk space for analysis output (2-3x memory dump size)
Optional: YARA rules for malware scanning in memory
Workflow
Step 1: Acquire Memory Dump and Install Volatility 3
# Install Volatility 3
pip install volatility3
# Or install from source for latest features
git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
pip install -e .
# Download Windows symbol tables (ISF packs)# Place in volatility3/symbols/ directory
wget https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip
unzip windows.zip -d /opt/volatility3/volatility3/symbols/
# Download Linux and Mac symbol packs
wget https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip
wget https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip
# Memory acquisition tools (for live systems):# Windows: winpmem, DumpIt, FTK Imager# Linux: LiME (Linux Memory Extractor)sudo insmod lime-$(uname -r).ko "path=/cases/memory/linux_mem.lime format=lime"# Verify the memory dump
file /cases/case-2024-001/memory/memory.raw
ls -lh /cases/case-2024-001/memory/memory.raw
Step 2: Identify the Operating System Profile
# Run banners plugin to identify the OS
vol -f /cases/case-2024-001/memory/memory.raw banners
vol -f /cases/case-2024-001/memory/memory.raw windows.info
vol -f /cases/case-2024-001/memory/linux_mem.lime linux.info
Information that exists only in RAM and is lost when power is removed
Process hollowing
Technique where malware replaces legitimate process memory with malicious code
DLL injection
Loading unauthorized DLLs into a running process address space
EPROCESS
Windows kernel structure representing a process; basis for process listing
Pool scanning
Searching memory for kernel object signatures to find hidden artifacts
VAD (Virtual Address Descriptor)
Memory management structure tracking process virtual memory regions
ISF (Intermediate Symbol Format)
Volatility 3 symbol table format for OS-specific structure definitions
Malfind
Plugin detecting injected code by examining VAD permissions and content
Tools & Systems
Tool
Purpose
Volatility 3
Primary open-source memory forensics framework
LiME
Linux Memory Extractor for acquiring Linux RAM dumps
WinPmem
Windows physical memory acquisition driver
DumpIt
Comae one-click Windows memory dump utility
YARA
Pattern matching engine for malware signature scanning
Rekall
Alternative memory forensics framework (Google)
MemProcFS
Memory process file system for memory analysis
strings
Extract printable strings from binary memory dumps
Common Scenarios
Scenario 1: Active Malware Investigation
Acquire memory with DumpIt, run pslist/pstree to identify suspicious processes, use malfind to detect injected code in svchost.exe, dump the injected memory segment, scan with YARA rules identifying Cobalt Strike beacon, extract C2 IP from netscan, correlate with network logs.
Scenario 2: Credential Theft After Breach
Run hashdump and lsadump to extract cached credentials, identify mimikatz execution in cmdline output, check for lsass.exe memory dumps in filesystem artifacts, correlate with lateral movement evidence in network connections.
Scenario 3: Rootkit Detection
Compare pslist (uses EPROCESS linked list) with psscan (pool scanning) to find unlinked processes, check modules vs modscan for hidden kernel drivers, examine SSDT for hooks redirecting system calls, dump suspicious modules for static analysis.
Scenario 4: Ransomware Incident Recovery
Extract encryption keys from ransomware process memory before system shutdown, identify the ransomware variant using YARA, find the initial execution point through command line artifacts, map lateral movement via network connections.
