Memory Forensics
Memory Forensics — Digital-forensics analysis of captured volatile memory to recover process, module, connection and runtime-state artifacts that may not exist on disk.
Why Memory?
A disk image preserves persistent storage, while volatile memory can contain information that exists only while a system is running: processes, loaded modules, active connections and application state.
That information can disappear after shutdown or as memory is reused, making acquisition timing important.
Acquisition and Interpretation
Capturing memory and interpreting it are separate problems. Operating-system version, architecture and kernel data structures have to be understood correctly. A parsed object is not automatically evidence of malicious behavior.
Forensic Integrity
Acquisition-tool effects, hashes, timestamps and evidence handling should be documented. Collecting live memory inevitably changes the running system to some degree; that impact needs to be understood rather than ignored.