RAM Analysis

If evidence of compromise is never written to a hard drive, we cannot rely on disk forensics!

Volatile memory has a high potential to contain:

• malicious code from an infection, in whole or in part, because it must be loaded in memory to execute.

• evidence that system resources were allocated by the malicious code.

• encryption keys and passwords, or the plain-text contents of files before they were encrypted.