Memory Forensics

Memory forensics digs into a system’s RAM to uncover what was happening in real time — from active processes to hidden malware. This page brings together articles and notes exploring different techniques, tools, and case studies in memory analysis.

ChatGPT Image Sep 30, 2025, 11_21_36 PM.png

Volatility: A Beginner’s Guide to Memory Analysis

Volatility is one of the most powerful tools in digital forensics, allowing investigators to extract and analyze artifacts directly from memory (RAM). In this beginner-friendly guide.......................

From RAM to Evidence (Part 2): Capturing Volatile Memory on Linux

In this second part of the Memory Forensics series, we explore how to capture volatile memory on Linux. From tools like LiME and AVML.....................

ChatGPT Image Sep 26, 2025, 10_55_50 PM.png

From RAM to Evidence (Part 1): Capturing Volatile Memory on Windows

Memory forensics begins with acquisition. In this first part of our series, we walk through capturing volatile memory on Windows using FTK Imager,..