Digital Forensics · 5 min
Memory & Process Evidence
What a running system knows that a powered-off one does not
This lesson explains the concept, then checks your understanding in a short interactive exercise.
Why memory matters
Volatile memory holds the state of a system as it is actually running — which can differ from what is written on disk.
- Running processes, including ones with no file on disk
- Active network connections and, depending on the platform and capture, remnants of recently closed connections
- Loaded modules and libraries
- Command lines and arguments used to start a process
- In some circumstances, secrets held in memory by running software
Qualify what memory shows
Memory is a snapshot of one moment, captured by tools that are themselves running on the system. Treat findings as time-bounded and tool-dependent.
- A capture reflects the instant it was taken, not the whole incident
- Acquisition itself uses memory and can perturb what is captured
- Absence of a process in the snapshot does not mean it never ran
- What is recoverable varies by operating system, version and configuration
Loading the interactive lesson…