Memory Forensics and Analysis with Volatility 3

In the previous chapters, we looked at the various methods for data carving and file recovery. In this chapter, we’ll look at the analysis of content stored in Random Access Memory (RAM) using the very powerful Volatility 3. RAM is volatile, meaning that the data in RAM is easily lost when there is no longer an electrical charge or current going to the RAM. With the data on RAM being the most volatile, it ranks high in the order of volatility and must be forensically acquired and preserved as a matter of high priority.

Many types of data and forensic artifacts reside in RAM and the paging file. As discussed in previous chapters, login passwords, user information, running and hidden processes, malware, and even encrypted passwords are just some of the many types of interesting data that can be found when performing RAM analysis, further compounding the need for memory forensics.

In this chapter, we will look at the very powerful...