thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Memory Forensics

Analysis of volatile memory captures to find running processes, network connections, injected code and other evidence.

Definition

Memory analysis reveals artifacts that never touch disk, such as fileless malware, decrypted payloads, encryption keys, command history and active connections. Memory is acquired with tools like WinPmem, DumpIt, Magnet RAM Capture or EDR, then analyzed with Volatility or MemProcFS.

Example

Using Volatility to find a hidden process with injected code in svchost.exe.

Exam tip

Memory capture must happen before shutdown; it is the top of the order of volatility.

Related terms