Memory forensics is the analysis of a computer's volatile memory (RAM) to extract evidence of malicious activity, running processes, network connections, encryption keys, and other artifacts that exist only in memory. Unlike disk forensics, memory forensics captures the live state of a system including data that may never be written to disk, such as fileless malware, injected code, and decrypted content. Memory forensics has become essential as adversaries increasingly adopt living-off-the-land techniques that leave minimal disk artifacts.
Memory acquisition is performed using tools that capture the full contents of physical memory to a file, either through software agents (WinPmem, LiME) or hardware devices (PCIe DMA). The resulting memory dump is analyzed using frameworks like Volatility or Rekall. Analysis techniques include process listing and tree reconstruction to identify suspicious parent-child relationships, DLL and module enumeration to detect injected code, network connection extraction to reveal C2 communications, registry hive parsing for configuration data, and string searching for credentials and indicators. Advanced techniques include YARA rule scanning against memory contents, identifying API hooking and SSDT modifications, and extracting encryption keys from process memory.
Modern malware increasingly operates entirely in memory, leaving no files on disk for traditional forensic tools to find. Fileless malware, PowerShell-based attacks, and process injection techniques are invisible to disk forensics alone. Memory forensics reveals the true state of a compromised system, including rootkits that hide from the operating system, encrypted data in its decrypted form, and the full scope of attacker activity. It provides the most accurate picture of what an attacker was doing at the time of capture.
CDA includes memory forensics as a core skill in the TID domain, with dedicated training in the Institute's M3 and M4 certification paths. Our C-HARDEN campaign missions deploy memory analysis capabilities and train responders in acquisition and analysis techniques. CDA operators use Volatility as the standard memory analysis framework, with findings documented as STIX observables for integration into the threat intelligence lifecycle.