[SEED CONTENT — replace] This article is placeholder copy seeded to exercise the layout. Swap it for a real write-up before launch.
A memory image captures what disk forensics can't: processes that never wrote to disk, decrypted strings sitting in RAM, and network connections that closed before anyone thought to look. Volatility3 is the standard tool for pulling all of that out.
Start with the process tree
vol -f memory.raw windows.pstree
Look for parent-child relationships that don't belong — a `services.exe` spawning `cmd.exe` spawning `powershell.exe` with no user-facing explanation is worth a closer look before anything else.
Pull network artifacts next
vol -f memory.raw windows.netscan
`netscan` recovers connection records even for processes that have since exited, which is often the first hard evidence of C2 activity when the process itself is long gone by the time you're imaging.
Hunt for injected code
- `windows.malfind` flags memory regions with suspicious protections (RWX) commonly associated with process injection.
- Cross-reference flagged PIDs against `pstree` output — injected code in a legitimate-looking process (`explorer.exe`, `svchost.exe`) is the classic pattern.
- Dump the suspicious region with `windows.memmap --dump` and run it through static analysis separately; don't try to conclude everything from Volatility output alone.
Common mistakes that waste a case
- Imaging after reboot. Volatile evidence is gone the moment the host restarts — image before any other response action if memory forensics is part of the plan.
- Ignoring the profile mismatch. Volatility3 auto-detects the OS profile, but a corrupted or partial image can produce misleading plugin output without an obvious error.
- Treating one plugin's output as conclusive. `pstree`, `netscan`, and `malfind` corroborate each other — a single plugin result is a lead, not a finding.
Memory forensics rewards patience. The artifacts are there; the skill is in cross-referencing enough of them that the story holds together.