Lion Cipher Lab
Analyze a memory image with Volatility 3
- Digital Forensics & IR (DFIR)
- Beginner
- ~45 min
- Free · no account required
Why it matters
A machine's RAM is one of the richest pieces of evidence in an investigation, and one of the most perishable. While a system is running, its memory holds the full list of running processes, the network connections open right now, the exact command lines that launched each program, decrypted data, and code that malware injected straight into another process without ever writing a file to disk. That last part is the point: a growing amount of modern malware is built to live only in memory precisely so that a disk-only examination misses it entirely. If you captured the volatile layer the way…
What you'll learn
- why RAM is high-value evidence
- installing Volatility 3
- running core plugins (pslist, netscan, cmdline)
- reading a process list and live connections from a memory image
- connecting capture (order of volatility) to analysis
Steps in this lab
- Why RAM is a goldmine
- Get a memory image you are allowed to analyse
- Install Volatility 3
- Identify the image before you analyse it
- List the running processes (pslist)
- Recover network connections (netscan)
- See how each program was launched (cmdline)
- What you can now do, and where it fits