Memory Forensics
Analyze memory dumps:
- Process enumeration
- Hidden process detection
- DLL analysis
- Code injection detection
- Network connections
- Credential extraction
- Registry artifacts
- Timeline generation
Required Context
- Dump File: Path to memory dump
- Focus: Injection, credentials, network, all
- OS: Windows/Linux (auto-detect)
Tools Used
Volatility 3, strings
Example
/memory
Dump: /forensics/memory.dmp
Focus: Injection detection, credentials