Memory forensics (sometimes referred to as memory analysis) refers to the analysis of volatile data in a computer's memory dump. It is used to investigate attacks on the system that are stealthy and do not leave data on the hard drive of the computer. In this chapter, we will cover some of the tools that can be used to analyze memory dumps and malicious files, and extract useful information from them.
In this chapter we will cover the following recipes:
- Using the volatility framework
- Using Binwalk
- Capturing a forensic image with guymager
