Analyzing Memory Images

Memory is the only place certain artifacts exist — injected code, decrypted payloads, credential material, and network connections from processes that have already exited. Disk forensics misses all of these. The work is getting the image before it is lost, then asking the right questions in the right order.

When to Use

• You have a memory dump (raw, LiME, EWF, crash dump, or VM snapshot) to analyze
• Investigating a compromised host and need artifacts that exist only in RAM
• Looking for injected code, process hollowing, or reflective DLL loading
• Extracting credential material — hashes, Kerberos tickets, cached credentials
• Identifying network connections and listening ports from a point-in-time capture
• Detecting kernel-level rootkits — SSDT hooks, DKOM, hidden drivers

When NOT to Use