Memory Forensics analyses RAM dumps to recover running processes, network connections, injected code, passwords, and attack artefacts.
Tools
- Volatility 3 — the primary framework.
- WinPmem / avml — memory acquisition.
Useful Plugins
pslist, netscan, malfind, dumpfiles, hashdump.