Hacking Trainer AcademyAmeerpet · Hyderabad
+91 86868 92922 Book free classes

SOC and blue team

Volatility for Beginners: Memory Forensics Cheat Sheet

· 2 min read · By Thimmagurudu Bathini, Lead Trainer and Curriculum Designer

A computer's memory holds things the disk never does: running processes, network connections, decrypted data and code that only exists while the machine is on. Volatility 3 is a free framework for examining a memory image. Practice with a memory image of your own lab virtual machine or with published training images.

Get a Memory Image

  • Easiest in a lab: suspend or snapshot a VirtualBox or VMware Windows VM and use the memory file (for example a .vmem file).
  • On a real machine, a tool such as WinPmem captures memory, only with authorization.
  • Hash the image and work on a copy, as in digital forensics for beginners.

Install and First Commands

  • pip3 install volatility3 (or clone the project from GitHub).
  • vol -f memory.vmem windows.info identifies the system.
  • vol -f memory.vmem windows.pslist lists processes; windows.pstree shows parent and child.
  • vol -f memory.vmem windows.cmdline shows each process's command line.
  • vol -f memory.vmem windows.netscan lists network connections.

If the vol command is not found, run python3 vol.py from the project folder instead.

What to Look For

  • A process with an unusual parent, such as a document reader starting a shell.
  • A system process name spelled slightly wrong, or running from the wrong folder.
  • Connections to addresses nobody can explain.
  • windows.malfind flags memory regions that look like injected code. It also has false positives, so treat results as leads.

Connect It to the Rest

Memory findings gain meaning next to logs and disk evidence. Compare process names with Sysmon events, and see how malware analysis and incident response use them.

Cheat Sheet

  • windows.info identifies the image.
  • windows.pslist and windows.pstree list processes and parents.
  • windows.psscan finds processes that were hidden or ended.
  • windows.cmdline shows command lines.
  • windows.netscan lists network connections.
  • windows.dlllist lists loaded libraries.
  • windows.filescan finds file objects in memory.
  • windows.malfind flags suspicious memory regions.

Where It Fits

Memory forensics appears in the malware and Windows forensics parts of the CHFI syllabus and in incident handling; see the ECIH exam guide.

Sources and Further Reading

Want to investigate a staged incident with a trainer? Book free trial classes. Contact us or call +91 86868 92922.

Courses Mentioned in This Guide

Intermediate to advanced · EC-Council certification

Computer Hacking Forensic Investigator (CHFI v11)

Investigate incidents and handle digital evidence properly.

₹37,000 + GST

  • Evidence acquisition
  • Disk and OS forensics
  • Network and cloud forensics
  • Reporting
View the certification →
Advanced · EC-Council certification

Certified Incident Handler (ECIH v3)

When the alert is real. Respond, investigate and recover.

₹34,000 + GST

  • Incident response
  • Digital forensics
  • Malware analysis
  • Legal compliance
View the certification →
Beginner to intermediate · Course · 6 weeks, 90 hours

SOC Analyst and DFIR

The core concepts of EC-Council's CCT, CSA, ECIH and CHFI, taught hands-on with Splunk, Wazuh and forensics tools, in six weeks.

₹20,000 + GST · 6 weeks

  • CCT, CSA, ECIH, CHFI core concepts
  • Splunk and Sentinel
  • Phishing triage and hunting
  • Incident handling
  • Forensics and malware analysis
View the course →

More Guides

SOC and blue team · 2 min read

Digital Forensics for Beginners: Chain of Custody and First Steps

A beginner guide to digital forensics: the investigation process, chain of custody, why you never work on the original, free tools to practice and the career.

Read the guide →
SOC and blue team · 2 min read

Autopsy and the Sleuth Kit for Beginners: Disk Forensics

Build a practice disk image, list and recover deleted files with The Sleuth Kit and review it in Autopsy, with commands for a Linux forensics lab.

Read the guide →
Certification · 2 min read

CHFI v11 Certification: Exam Format, Eligibility and 15 Modules

What the EC-Council CHFI exam looks like: 150 questions in 4 hours, the 15 modules, 68 labs, who can start and what digital forensics work involves.

Read the guide →
SOC and blue team · 2 min read

Ransomware Explained: How It Works and How to Respond

How ransomware gets in, spreads and encrypts, what double extortion means, the defenses that matter and the first response steps for a security team.

Read the guide →

Start Your Cyber Security Career

Talk to a counselor, choose the right course for your goals, and get the fee, syllabus and next batch dates in writing.

Book Free Trial Classes

By submitting, you agree that Hacking Trainer Academy may contact you about courses by phone, WhatsApp or email. See our privacy notice and refund policy.

WhatsApp