memory-forensics-volatility

memory-forensics-volatility is a defensive digital-forensics playbook for analyzing memory dumps with the Volatility framework, covering both the version 2 and version 3 command sets. It is oriented toward incident response and malware analysis: identifying the source operating system, reconstructing process activity, reviewing network connections, examining loaded modules, detecting code injection, recovering artifacts, and building an investigation timeline.

The playbook is organized as a methodology. It begins with memory acquisition options across Linux, Windows, and virtual-machine environments, then moves to operating-system identification. Process analysis compares a standard process listing against a pool-tag scan to surface objects that have been unlinked from the kernel's process list, and a process tree highlights unexpected parent-child relationships. Subsequent steps walk through network endpoint enumeration, DLL and module review to spot modules absent from the loader lists, and injection detection that looks for executable-and-writable memory regions with no backing file on disk. Further sections address credential-store and registry artifacts, file-object recovery, command history, and timeline generation, with a dedicated section for Linux memory and rootkit-oriented checks such as syscall and TTY integrity.

A recurring theme is the difference between Volatility 2 and Volatility 3 syntax, profiles versus auto-detected symbol tables and the renamed, namespaced plugins, captured in a side-by-side comparison table plus a companion cheat-sheet reference. A malware-indicators table pairs each observable signal with its detection method and forensic meaning, for example a process visible to a pool scan but not the linked list pointing to kernel-object manipulation, or executable-and-writable memory without a file mapping suggesting injected code. Reach for it during memory-dump investigations, credential-exposure reviews, process and injection triage, and timeline reconstruction. Related routing points to companion playbooks for network-capture correlation, hidden-data inspection in recovered files, and understanding post-exploitation artifacts, so memory findings can be cross-checked against other evidence sources.