domains / families / security / conducting-memory-forensics-with-volatility

conducting-memory-forensics-with-volatility

separate

'Performs memory forensics analysis using Volatility 3 to extract evidence

When to use

• An endpoint has been contained during an active incident and volatile evidence must be preserved
• EDR alerts suggest process injection or fileless malware that only exists in memory
• Encryption keys need to be recovered from a ransomware-infected system before shutdown
• Credential theft (Mimikatz, LSASS dumping) is suspected and evidence must be confirmed
• A rootkit or kernel-level compromise is suspected and disk-based analysis is insufficient

When not to use

• analyzing disk images
• file system artifacts

Skill page

Source