Memory analysis

After a successful memory acquisition process, the investigator will have a single dump file that contains the full memory. Fortunately, the structure of the memory can be parsed by many analysis programs, including volatility, which is the most famous memory analysis framework nowadays.

The volatility framework

A free memory forensics framework can be downloaded from http://www.volatilityfoundation.org. This framework supports many versions of Windows, Mac, and Linux operating systems. An independent book called Art of Memory Forensics was released with volatility 2.4. It explains in detail different operating systems' artifacts in memory and how to extract and analyze them using the volatility framework. In this section, we will discuss the usage of volatility framework and how it detects the malicious activities in memory dump.

Each operating system has a different memory structure. Volatility has the ability to understand different structures. Using this profile...