Tag: Volatility

1. Introduction Memory forensics with Volatility has become the reference technique for reconstructing security incidents when the attacker has managed to conceal their tracks on disk. Volatile memory holds information that no filesystem preserves: running processes, active network connections, malware fragments loaded in RAM and, very often, cleartext credentials. This article is a complete hands-on guide in which we carry out a real lab of memory forensics with Volatility on an image from a compromised Windows 7 SP1 x64 machine, infected through a Metasploit payload. During the lab we profile the memory dump, identify an injected process, extract NTLM hashes …