# Course 36 - Windows Forensics and Tools | Episode 4: From Acquisition to Volatility Analysis

Page: https://stenobird.com/podcast/cybercode-academy-7578615/course-36-windows-forensics-and-tools-episode-4-from-acquisition-to-volatility-analysis
Text version: https://stenobird.com/podcast/cybercode-academy-7578615/course-36-windows-forensics-and-tools-episode-4-from-acquisition-to-volatility-analysis.md
Podcast: [CyberCode Academy](https://stenobird.com/podcast/cybercode-academy-7578615)
Published: 2026-06-02T06:00:02+00:00
Episode link: https://www.spreaker.com/episode/course-36-windows-forensics-and-tools-episode-4-from-acquisition-to-volatility-analysis--72013631
Audio file: https://dts.podtrac.com/redirect.mp3/api.spreaker.com/download/episode/72013631/catching_malware_that_hides_in_ram.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/cybercode-academy-7578615/episodes/course-36-windows-forensics-and-tools-episode-4-from-acquisition-to-volatility-analysis
Duration seconds: 1330

## Resource

In this lesson, you’ll learn about: memory forensics and RAM analysis1. Why Memory Forensics Matters RAM (volatile memory) is one of the most valuable forensic sources It contains data that disappears after shutdown 🔹 What RAM can reveal Running processes Active network connections Command history Encryption keys Malware behavior in real time 👉 Key Idea: If disk is “history,” RAM is live truth 2. Memory Acquisition (Capturing RAM)🔹 What is memory acquisition? Creating a snapshot of physical RAM for analysis 🔹 Common Tools DumpIt Simple one-click RAM dump tool Used widely in field forensics NotMyFault Forces system crash Generates full kernel memory dump 👉 Key Tradeoff: DumpIt → fast and simple Crash dump → deeper but disruptive 3. Types of Memory Evidence🔹 What investigators look for Process objects Suspicious threads Injected code Hidden malware artifacts 🔹 Why it’s important Malware often exists only in memory Disk analysis alone may miss it 4. Memory Forensic Techniques🔹 String Searching Look for: Passwords URLs Commands API keys 🔹 Process Inspection Identify: Legitimate processes Suspicious or orphaned processes 🔹 Thread Analysis Detect: Code injection Hidden execution paths 5. Deep Analysis with Volatility🔹 What is Volatility? A powerful memory forensics framework for analyzing RAM dumps 🔹 Key Capability Extracts structured evidence from raw memory images 6. Core Volatility Commands🔹 pslist Shows active processes Based on system process list 🔹 psscan Finds hidden or terminated processes Scans memory directly 🔹 psxview Cross-checks multiple process sources Detects rootkits and hidden malware 👉 Key Insight: If a process appears in psscan but not pslist, it may be hidden 7. OS Profiling First step in analysis is identifying: Operating system version Memory structure…

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/cybercode-academy-7578615/episodes/course-36-windows-forensics-and-tools-episode-4-from-acquisition-to-volatility-analysis/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/cybercode-academy-7578615/course-36-windows-forensics-and-tools-episode-4-from-acquisition-to-volatility-analysis.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.