Memory forensics can reveal processes, network connections, credentials, and decrypted data that never touched disk. The workflow starts with a clean acquisition and strict chain of custody.
Acquisition checklist
- Capture RAM as early as possible to reduce contamination.
- Record time, host, OS build, and acquisition tool version.
- Hash the dump and verify integrity at each handoff.
Common artifact classes
- Process trees and injected modules.
- Network sockets and DNS cache fragments.
- Credential material from LSASS or browser memory.
Preservation tips
- Store the original dump read-only.
- Work on copies and log every transformation step.
- Maintain hashes for derived evidence files.
Next log: building a triage pipeline with Volatility and custom YARA rules.