memory-forensics-volatility

Memory forensics detects hidden processes and malware injection by comparing linked process lists against scanned entries, inspecting parent-child relationships, and using malfind-style indicators to identify unlinked or injected process memory regions.

Credential extraction from a raw memory dump recovers actionable investigation artifacts including password hashes, LSA secrets, and cached credentials using specific Volatility plugins designed for Windows memory analysis.

Memory forensics supports both Linux and Windows dump triage using Volatility 2 and 3 workflows, requiring a Volatility profile for version-specific analysis or relying on Volatility 3 auto-detection for automatic profile selection.

Timeline reconstruction from memory artifacts uses the Volatility timeliner plugin to aggregate process execution, network connections, and registry modifications into a chronological incident timeline for forensic investigation.

Incident response investigation of process injection enumerates loaded modules and DLLs, cross-references scanned versus linked process lists, and applies malfind-style checks to isolate injected code within process memory spaces.

Process discovery in digital forensics uses pslist to enumerate active linked processes and psscan to uncover hidden or terminated processes by scanning raw memory, revealing discrepancies that indicate rootkit or malware concealment.