What Is Memory Forensics?

Memory forensics is the capture and analysis of a system's volatile memory. It has become central to intrusion investigation because a growing share of malicious activity never touches disk at all.

It is also the most perishable evidence available: memory contents are gone the moment power is lost, which makes the decision to capture one of the first that has to be made correctly.

What only memory contains

Running processes and their full command lines, including arguments that reveal what a tool was instructed to do. Injected code with no corresponding file. Decrypted payloads, since packed malware must unpack itself to execute.

Network connections in progress. Credentials and keys in plaintext, which is why credential theft tooling targets memory. And the contents of scripts executed in memory by interpreters, which leave nothing behind otherwise.

Why fileless techniques made it essential

Fileless malware resides in memory and uses tooling already present on the system. Disk analysis of such an intrusion finds legitimate binaries and no malicious files, which is a finding of nothing.

Living off the land techniques produce the same result. The evidence of intent is in how those legitimate tools were invoked, and that lives in memory and in process telemetry.

Capture, and the trade-off in doing it

Acquisition requires running a tool on the live system, which changes the memory being captured and may be detected by adversary tooling. That is an accepted cost — an imperfect capture is incomparably better than none.

The capture should be written to external storage rather than the local disk, which would overwrite unallocated space that may hold evidence. And it should happen before isolation changes network state, or at least be understood to reflect the state after it.

What analysis produces

Process listings including entries hidden from the operating system's own view. Injected regions mapped to the processes hosting them. Network connections tied to the processes that opened them. Recovered command lines, scripts and configuration extracted from running malware.

That configuration frequently includes command and control addresses, which convert an isolated finding into an indicator that can be searched across the whole estate.

The practical constraints

Capture size equals system memory, so a large server produces a very large file and transferring it takes time. Encrypted and protected memory regions may be inaccessible. Virtual machine snapshots offer an easier path, since the hypervisor can capture memory without touching the guest at all.

Virtual and containerised systems

Where the system is virtual, the hypervisor can capture memory without running anything inside the guest — no footprint, no chance of the sample noticing, and a snapshot that includes memory state. Where that is available it is the preferred route.

Containers are the opposite problem. They are frequently short-lived and replaced automatically, so the evidence is gone before anyone looks. Preserving a suspect container image and its memory requires suspending the orchestration that would otherwise recycle it, which has to be done deliberately and quickly.

Where to start

Establish whether your responders have a memory acquisition tool available and know how to use it, before an incident. It is a small piece of preparation that determines whether the best evidence survives.

See digital forensics. GuardsArm delivers incident response.