Technical Procedures
Memory Forensics Basics
Introduction to memory forensics for incident responders, covering acquisition and basic analysis.
Technical Procedures · intermediate · 2-4 hours
Fundamental procedures for capturing and analyzing system memory during incident response.
Steps
5
01
Pre-Acquisition Preparation
Prepare for memory capture.
- Verify memory acquisition tools are available
- Ensure sufficient storage for memory dump
- Document system state before acquisition
- Plan for minimal system impact
WinPmem · FTK Imager · LiME (Linux) · External storage
02
Memory Acquisition
Capture system memory.
- Run acquisition tool with proper permissions
- Capture to external or network storage
- Hash the memory dump upon completion
- Document acquisition time and method
03
Analysis Environment Setup
Prepare for memory analysis.
- Install Volatility or similar analysis framework
- Identify correct profile for the captured system
- Verify dump integrity with hash
Volatility 3 · MemProcFS · Rekall
04
Basic Analysis
Perform initial memory analysis.
- List running processes
- Identify network connections
- Check for code injection indicators
- Extract suspicious processes for further analysis
- Look for malware artifacts
05
Documentation
Document findings.
- Record all analysis commands and output
- Document suspicious findings
- Preserve extracted artifacts
- Write analysis summary
Checklist
- Tools prepared and verified
- Memory successfully captured
- Dump hashed for integrity
- Chain of custody documented
- Analysis profile identified
- Process list extracted
- Network connections analyzed
- Suspicious artifacts identified
- Findings documented
Evidence
- Memory dump file
- Memory dump hash
- Analysis tool output
- Extracted artifacts
- Analysis notes