Disks hold what was saved, but memory holds what is happening right now. RAM contains running processes, open network connections, loaded code, and sometimes credentials, and all of it disappears when the machine is powered off. Memory forensics is the practice of capturing and analysing that volatile data before it's lost.
You'll learn why memory is captured early in an investigation, how to take a RAM capture with tools such as FTK Imager, and how to analyse a memory image with Volatility 3. Typical tasks include listing processes, checking network connections, dumping files, and spotting signs of malware that never touched the disk.
Next up is Network Forensics, where you'll follow activity across the network using packet captures and logs.
Why RAM is the most volatile evidence on a system, why it can be lost so easily, and why capturing a memory dump matters.
A demonstration of capturing RAM on Windows using four different tools, including AccessData FTK Imager.
Installing Volatility 3 and using it to list processes, check network connections, dump files, and run basic registry analysis on a RAM image.
A full memory forensics workflow for hunting malware, using a real Windows RAM dump and Volatility 3.