Episode
Course 36 - Windows Forensics and Tools | Episode 4: From Acquisition to Volatility Analysis
- Podcast
- CyberCode Academy
- Published
- Jun 2, 2026
- Duration seconds
- 1330
- Processing state
not_requested
Actions
POST https://stenobird.com/v1/public/podcasts/cybercode-academy-7578615/episodes/course-36-windows-forensics-and-tools-episode-4-from-acquisition-to-volatility-analysis/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/cybercode-academy-7578615/course-36-windows-forensics-and-tools-episode-4-from-acquisition-to-volatility-analysis.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
In this lesson, you’ll learn about: memory forensics and RAM analysis1. Why Memory Forensics Matters RAM (volatile memory) is one of the most valuable forensic sources It contains data that disappears after shutdown 🔹 What RAM can reveal Running processes Active network connections Command history Encryption keys Malware behavior in real time 👉 Key Idea: If disk is “history,” RAM is live truth 2. Memory Acquisition (Capturing RAM)🔹 What is memory acquisition? Creating a snapshot of physical RAM for analysis 🔹 Common Tools DumpIt Simple one-click RAM dump tool Used widely in field forensics NotMyFault Forces system crash Generates full kernel memory dump 👉 Key Tradeoff: DumpIt → fast and simple Crash dump → deeper but disruptive 3. Types of Memory Evidence🔹 What investigators look for Process objects Suspicious threads Injected code Hidden malware artifacts 🔹 Why it’s important Malware often exists only in memory Disk analysis alone may miss it 4. Memory Forensic Techniques🔹 String Searching Look for: Passwords URLs Commands API keys 🔹 Process Inspection Identify: Legitimate processes Suspicious or orphaned processes 🔹 Thread Analysis Detect: Code injection Hidden execution paths 5. Deep Analysis with Volatility🔹 What is Volatility? A powerful memory forensics framework for analyzing RAM dumps 🔹 Key Capability Extracts structured evidence from raw memory images 6. Core Volatility Commands🔹 pslist Shows active processes Based on system process list 🔹 psscan Finds hidden or terminated processes Scans memory directly 🔹 psxview Cross-checks multiple process sources Detects rootkits and hidden malware 👉 Key Insight: If a process appears in psscan but not pslist, it may be hidden 7. OS Profiling First step in analysis is identifying: Operating system version Memory structure…