Memory analysis
After a successful memory acquisition process, the investigator will have a single dump file that contains the full memory. Fortunately, the structure of the memory can be parsed by many analysis programs, including volatility, which is the most famous memory analysis framework nowadays.
The volatility framework
A free memory forensics framework can be downloaded from http://www.volatilityfoundation.org. This framework supports many versions of Windows, Mac, and Linux operating systems. An independent book called Art of Memory Forensics was released with volatility 2.4. It explains in detail different operating systems' artifacts in memory and how to extract and analyze them using the volatility framework. In this section, we will ...
Get Practical Windows Forensics now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
