Summary

This chapter discussed two major topic areas of memory analysis. First, we covered the available data points and the methodology that can be followed. In addition, several tools, such as Volatility, Volatility Workbench, and Strings, have been explored. In addition to an overview of these tools, several of their features have been explored. This only scratches the surface of the number of features each of these tools has to offer the incident response analyst. These tools, taken in conjunction with a methodology for analyzing system RAM, can give the analyst a powerful tool for determining if a system has been compromised. With malware becoming more advanced, including malware that executes entirely in RAM, analysts must incorporate memory analysis into their capabilities. Marrying these techniques with network evidence collection can provide analysts and their organizations with a powerful tool to identify and remediate an incident.

In the next chapter, we will delve into...