10 · Memory Forensics
Windows Memory Forensics with Volatility 3: Practical Guide
Acquire Windows RAM, use hiberfil and pagefile, and run a Volatility 3 workflow to find injected code, hidden processes and network activity.
Area 10
Memory Forensics
Some evidence only ever exists in RAM. This area covers memory acquisition, hibernation and page files as fallbacks, the core Volatility 3 plugins, hunting process anomalies and injected code, and the traps of compressed memory, smear and virtualisation-based security.
Key sources
- Volatility 3
- hiberfil.sys
- pagefile.sys
Guides in this area
Artifact cheat sheets
Location by Windows version, what each artifact proves, its timestamps and the tools to parse it.
- hiberfil.sys (hibernation file)hiberfil.sys cheat sheet: what hibernation and Fast Startup save, compression by Windows version, converting it to a raw memory image and what it can reveal.
- pagefile.sys and swapfile.syspagefile.sys and swapfile.sys cheat sheet: paged-out memory on disk, what can be recovered, ClearPageFileAtShutdown, compression caveats and carving tools.
- Crash dumps (MEMORY.DMP, minidumps)Crash dump cheat sheet: MEMORY.DMP and minidump locations, CrashControl dump types, user-mode dumps, LSASS dumping traces and tools to analyse them.
- Windows Error Reporting (WER)Windows Error Reporting cheat sheet: Report.wer folders, AppPath and SHA-1 fields, Application events 1000/1001/1002, LocalDumps crash dumps and retention.