Memory Forensics

What Memory Forensics teaches: capture and analyze volatile memory across Windows and Linux to find the fileless malware, injected code, and stolen credentials that never touch disk. The attack-capture-analyze model you'll work, the free toolkit and lab, and how the course is structured. Start here.

Acquisition as a standard IR step, not a specialist exception. The acquisition problem and smear, WinPmem on Windows, LiME and AVML on Linux, hypervisor capture, pagefile and swap, verification and the acquisition record, smear measurement, anti-acquisition, and the clean baselines the rest of the course compares against.

The first transient-artifact category in depth. Run a reflective injection against your lab, capture it cleanly, and find it with converging evidence. The process abstraction, VAD tree, protection metadata, the four-line finding method, the replacement techniques the additive workflow misses, and extracting the injected code.

Detecting and proving credential theft from a captured image. The LSASS authentication architecture, NTLM hashes and Kerberos tickets, the exposure assessment, Credential Guard's partial protection, the memory signatures that prove a tool read LSASS, and the non-LSASS sources that widen the blast radius.

Investigating malware that lives only in memory. Why fileless attacks defeat disk forensics, how PowerShell delivers and reflectively loads a payload, and how to prove the load, extract and identify the payload, recover the C2 configuration, and build a timeline, all from a memory image that is the only evidence there is.

Finding the mechanisms attackers install to survive a reboot. Scheduled tasks across their three artifact locations, WMI event subscriptions in the framework repository, and registry persistence, all read from the authoritative in-memory copy that a tampered disk cannot match, because the active session's evidence dies at reboot but persistence is built to outlast it.

When the attacker stops being a tenant of the system and becomes a co-owner of the kernel. Loading a driver, registering callbacks, and unlinking from the lists enumeration trusts, met by the offline analysis that reads the pool the kernel cannot fake: driver detection, callback attribution, system-call-table checks, and the DKOM detection floor.

Work a two-stage Linux intrusion in memory on SRV-NGE-MCR-APP01: an SSH brute force into a sudo misconfiguration to root and a credential harvest, then an LKM rootkit that hooks getdents64 to hide a process. Capture at both stages and read what each left behind, task_struct enumeration, bash history from the heap, credential recovery, module list versus slab scan, and syscall-table integrity, then detect the eBPF variant the LKM checks miss.

Build a defensible timeline from your MF2-MF7 captures. Classify every timestamp by who wrote it, corroborate against event logs, the MFT and the perimeter, measure clock skew before ordering anything across hosts, and read manipulation as evidence rather than as a ruined timeline.

Take one intrusion from alert to defensible report: predict artifacts before capturing, place three checkpoints against decay, read each stage as a delta, merge uneven evidence without flattening it, and write for readers who will never see an image.

The lookup layer: every command the course teaches, grouped by what you are trying to establish.

Procedures: what you do, in what order, and what each step must produce.

Build the environment that produces the evidence this course analyzes.

Complete investigations worked end to end, including the wrong turns.

Detonation procedures. Each produces the artifact a module teaches you to find, so you analyze evidence whose ground truth you already know.

Resources for practicing memory forensics and using it at work: an open-source DFIR toolkit, the forensic lab, the detection library, response playbooks, and guided investigations.

External sources this course draws on: tooling documentation, research, standards and community memory forensics material.

Memory Forensics end-of-course exam: a three-phase simulation testing whether you can apply the method to a case the course did not walk through.