01 · Acquisition & Triage
Windows Live Response: What to Capture, in Which Order
Windows live response in practice: order of volatility, memory first, processes, network and sessions, trusted tooling, hashing output and your own footprint.
Articles tagged: #memory-forensics
10 · Memory Forensics
Windows Memory Forensics with Volatility 3: Practical Guide
Acquire Windows RAM, use hiberfil and pagefile, and run a Volatility 3 workflow to find injected code, hidden processes and network activity.