Back to Articles

Memory Forensics with Volatility

Digital Forensics Advanced 📅 Published: 25/08/2025

Memory forensics is the art of analyzing volatile system memory to uncover evidence of malicious activity. Volatility is the de facto standard tool...

Memory Forensics with Volatility

Memory forensics is the art of analyzing volatile system memory to uncover evidence of malicious activity. Volatility is the de facto standard tool for this type of analysis.

Why Memory Forensics?

Memory contains a wealth of information that's never written to disk:

  • Running processes and their command lines
  • Network connections and sockets
  • Loaded modules and drivers
  • Registry keys and handles
  • Injected code and rootkits

Essential Volatility Commands

# Identify the operating system profile
volatility -f memory.dump imageinfo
# List running processes
volatility -f memory.dump --profile=Win7SP1x64 pslist
# Detect hidden/terminated processes
volatility -f memory.dump --profile=Win7SP1x64 psscan
# Show network connections
volatility -f memory.dump --profile=Win7SP1x64 netscan
# List loaded modules
volatility -f memory.dump --profile=Win7SP1x64 modules

Hunting for Malware

Several techniques help identify malicious activity:

  • Process hollowing detection - Compare disk vs memory images
  • Injection analysis - Look for suspicious memory regions
  • Rootkit detection - Compare different process listing methods
  • Timeline analysis - Correlate events across different artifacts

Advanced Analysis

For deeper investigation, you can extract and analyze specific artifacts:

# Dump a specific process
volatility -f memory.dump --profile=Win7SP1x64 procdump -p 1234 -D output/
# Extract injected code
volatility -f memory.dump --profile=Win7SP1x64 malfind -p 1234

Memory forensics is particularly valuable for incident response and advanced persistent threat (APT) investigations where attackers use fileless techniques.