Network & Memory Forensics
RAM holds encryption keys, running malware, and network state that never touches disk. Combined with packet capture and log analysis, memory forensics answers questions a disk image alone cannot.
What is network & memory forensics?
Memory forensics is the acquisition and analysis of a system's volatile RAM — capturing running processes, network connections, injected code, and encryption keys that exist only while the system is powered on. It sits near the top of the order of volatility, meaning it should generally be captured before disk imaging on a live-response engagement.
Network forensics complements this by analyzing traffic captured in transit — packet captures, firewall logs, and proxy records — to identify command-and-control channels, data exfiltration, and lateral movement that memory alone may only partially reveal.
Acquire Live
Capture RAM first, before disk imaging, per the order of volatility.
Analyze
Volatility 3 plugins surface processes, connections, and injected code.
Correlate
Cross-reference memory findings against packet captures and firewall logs.
Step-by-Step Methodology
The sequence a careful examiner follows, in order.
- 1
Respect the order of volatility
Capture RAM before disk imaging on any live system — registers and cache decay in nanoseconds, RAM in minutes to hours, disk data persists far longer.
- 2
Acquire a full memory image
Use FTK Imager, Magnet RAM Capture, or DumpIt on Windows; LiME or AVML on Linux — choosing a tool with the smallest possible memory footprint to minimize evidence contamination.
- 3
Triage running processes
Run Volatility 3's pslist and pstree to build a process inventory and ancestry tree, looking for unexpected parent-child relationships or unfamiliar process names.
- 4
Hunt for injected code
Run malfind to identify memory regions with suspicious read-write-execute permissions and no backing file on disk — a strong indicator of process injection.
- Extract and hash suspicious regions for reputation lookup (e.g., VirusTotal)
- Use cmdline to recover the full launch command of flagged processes
- 5
Reconstruct network state
Run netscan to recover active and recently closed socket connections captured in memory, even for processes that have since exited.
- 6
Correlate with packet captures and logs
Cross-reference IPs and timestamps found in memory against Wireshark/tcpdump captures, firewall logs, and proxy logs to confirm and extend the timeline of network activity.
- 7
Extract credentials in scope
Where properly authorized, run hashdump to identify cached credentials present in memory at capture time, informing which accounts require immediate remediation.
Tools Comparison
Sortable — click any column header.
Commands & Code
Copy-ready snippets used in real workflows.
# Process listing and ancestry
vol.py -f memory.raw windows.pslist
vol.py -f memory.raw windows.pstree
# Network connections captured in memory
vol.py -f memory.raw windows.netscan
# Hunt for injected code (RWX regions with no backing file)
vol.py -f memory.raw windows.malfind
# Recover full command lines for flagged processes
vol.py -f memory.raw windows.cmdline
# Extract cached credential hashes (requires proper authorization)
vol.py -f memory.raw windows.hashdump# Build and load the LiME kernel module to capture Linux RAM
insmod lime.ko "path=/mnt/usb/capture.lime format=lime"
# Verify the capture completed and hash it
sha256sum /mnt/usb/capture.lime# Capture traffic on a specific interface to a rotating set of pcap files
tcpdump -i eth0 -w /evidence/capture.pcap -C 500 -W 10
# Filter for a specific host of interest while capturing
tcpdump -i eth0 host 198.51.100.20 -w /evidence/host_of_interest.pcapLegal & Ethical Considerations
- Live memory acquisition on a production system requires clear authorization — coordinate with system owners and legal/incident-response leadership before acting.
- Credential extraction (hashdump) touches sensitive account data; scope and handle it under the same authorization and access controls as any other credential material.
- Packet capture on a network may implicate wiretap or interception statutes depending on jurisdiction — ensure monitoring authority is documented before capturing live traffic.
- Document the exact acquisition tool, version, and memory footprint used, since the acquisition process itself alters the system's memory state to some degree.
Common Mistakes
- Powering off a compromised system before capturing RAM, destroying encryption keys, injected malware, and network state that only existed in memory.
- Using a memory-heavy acquisition tool that significantly disturbs the very evidence being captured — prefer lightweight, purpose-built acquisition utilities.
- Relying on pslist alone, which can be evaded by malware that unlinks itself from the OS's active process list — cross-check against other plugins and raw pool scanning.
- Treating hash-reputation attribution (e.g., a VirusTotal match) as definitive rather than 'consistent with' a known malware family.