---
description: wait, what did i eat for breakfast?
---

# Memory Forensics

{% hint style="info" %}
Memory Forensics is the analysis of the volatile memory, mainly Random Access Memory (RAM).
{% endhint %}

### Volatility

What is Volatility?

* [**Volatility**](https://github.com/volatilityfoundation/volatility3) extracts digital artifacts from volatile memory (RAM) samples. memory capture file is like .bin, .mem, .raw, .sav, .vmem.

```python
# OS information
python vol.py -f <filename> windows.info

# Process information
python vol.py -f <filename> windows.pslist
python vol.py -f <filename> windows.psscan
python vol.py -f <filename> windows.pstree

# Network connections
python vol.py -f <filename> windows.netscan

# Hidden processes
python vol.py -f <filename> windows.ldrmodules

# Detect malware
python vol.py -f <filename> windows.malfind

# DLL files
python vol.py -f <filename> windows.dlllist
```

### External References

{% embed url="https://www.youtube.com/watch?v=gHbejxlPbRQ" %}

<figure><img src="https://1326575018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWOW1TQuFBNIp3aDtWk3v%2Fuploads%2Fa86SDqj430ibIV9eKdus%2Fimage.png?alt=media&#x26;token=d6e9e95f-ba69-4e5e-a155-ff3bca69e964" alt=""><figcaption></figcaption></figure>
