- Nationwide Digital Forensic & Cyber Investigation Services
Some of the most important evidence in a business intrusion exists only in a machine active memory, and it disappears the moment power is lost. This page explains what memory forensics can prove that disk based analysis cannot, how examiners capture and analyze RAM with tools like Volatility 3, and the special handling required for hibernation files, pagefiles, and cloud hosted virtual machines.
| Question | One line answer |
|---|---|
| What can memory prove that disk cannot? | Injected code, decrypted keys and credentials, active network connections, and fileless malware that never wrote to disk. |
| When must memory be captured? | Before the system is powered off or rebooted, since RAM contents are lost immediately at power loss. |
| What tool do examiners use to analyze memory? | Volatility 3 is a widely used open source framework for extracting artifacts from a captured memory image. |
| Can a hibernation file substitute for a live capture? | It can preserve a snapshot of memory state at the time of hibernation, though it is not equivalent to a fresh capture. |
| Does the pagefile matter? | Yes. Portions of memory can be written to the pagefile and recovered even after the original process has ended. |
| Can memory be captured from a cloud virtual machine? | Often yes, using provider snapshot features or in guest capture tools, though the method depends on the cloud platform. |
| Term | What it means |
|---|---|
| Volatile memory | Data stored in RAM that exists only while a system is powered on and is lost immediately upon shutdown or reboot. |
| Memory image | A forensically captured, complete copy of a system RAM contents at a specific point in time, preserved for later analysis. |
| Fileless malware | Malicious code that executes entirely within memory or through legitimate system processes without writing a traditional executable file to disk. |
| Process injection | A technique where malicious code is inserted into the memory space of a legitimate running process to evade detection. |
| Hibernation file | A file, commonly hiberfil.sys on Windows, containing a saved copy of memory contents written to disk when a system enters hibernation. |
| Pagefile | A file used by the operating system as an extension of physical memory, which can retain fragments of process memory even after the process ends. |
Disk forensics answers what files existed and what likely ran. Memory forensics answers what was actually running, in what state, with what decrypted content, at the precise moment of capture. Several categories of evidence exist meaningfully only in memory.
In ransomware investigations, memory captured before encryption completes or before the host is rebuilt can reveal the encryption key or the specific process responsible. In business email compromise cases, memory can sometimes reveal session tokens or credentials used to access a mailbox, information that never appears in any disk artifact.
Capture timing is the defining constraint of memory forensics. Once a system is powered off, its RAM contents are gone, and no acquisition method can recover them afterward.
Assess whether capturing memory is safe and appropriate given the incident, since some capture tools require running additional software on a potentially compromised host.
Use a trusted memory acquisition tool to create a complete image of physical memory, documenting the tool, version, and hash of the resulting image.
Preserve the image with a documented chain of custody before any further action is taken on the live system.
Analyze the image using Volatility 3, an open source framework capable of extracting process lists, network connections, loaded modules, and injected code.
Correlate memory findings with disk, network, and log evidence to build a complete and corroborated timeline.
Volatility 3 organizes analysis around plugins that reconstruct specific artifact types from the raw memory image, including running processes, network connections, command line arguments, and evidence of process hollowing or code injection. Because the underlying data is a static image rather than a live system, analysis can be repeated and independently verified, which supports its use as reliable forensic evidence.
If a system is still running, memory capture may be possible right now. We can advise immediately on whether and how to capture it safely.
Not every incident allows for a live memory capture, and several alternate or supplementary sources deserve specific attention.
When a Windows system was hibernated rather than shut down, the hiberfil.sys file contains a compressed snapshot of memory at that moment, which examiners can convert and analyze similarly to a live capture.
The pagefile.sys file on Windows can retain fragments of process memory that were paged out of physical RAM, sometimes surviving even after the original process has terminated.
Provider level snapshot features can sometimes capture memory state for a cloud hosted virtual machine, though availability and fidelity vary by platform and instance type.
When provider snapshot memory capture is not available, an examiner may need to run a memory acquisition tool inside the guest operating system before it is powered off or migrated.
None of these alternates is a perfect substitute for a timely live capture, but each can meaningfully narrow the evidentiary gap when live capture was not possible.
A memory image is a snapshot, not a recording. It reflects the system state at the exact moment of capture and says nothing directly about what happened before or after that moment.
A defensible report distinguishes clearly between what the memory image directly shows and what is inferred from correlating it with other evidence sources.
The live RAM contents are gone, but hibernation files, pagefiles, and swap data can sometimes preserve fragments of the prior state.
Common ransomware and commodity malware frequently use techniques, such as process injection, that are best or only observed in memory.
Capture requires care to avoid overwriting relevant memory pages and should follow a documented, repeatable methodology.
Many cloud platforms support memory inclusive snapshots or allow in guest capture, though the specific method depends on the provider and configuration.
We provide rapid memory forensic response for businesses facing active or recently discovered intrusions. Our examiners advise on safe capture timing, perform sound acquisition across physical, virtual, and cloud hosted systems, and analyze the resulting images with Volatility 3 and complementary methods to answer questions disk evidence alone cannot.
Immediate advice on whether and how to safely capture memory from a system that is still running.
Forensically sound capture of physical, virtual, and cloud hosted system memory with documented methodology.
Extraction of processes, network connections, injected code, and credentials from a captured memory image.
Recovery and analysis of memory resident evidence preserved in hibernation files and pagefiles when a live capture was not possible.
Analysis aimed at recovering encryption related artifacts from memory during an active ransomware event.
Court qualified examiners able to explain memory forensic methodology and findings under cross examination.
Consultations are confidential. We work directly with affected businesses, with outside counsel, and with cyber insurance carriers and brokers nationwide.
Elite Digital Forensics is an independent digital forensics firm serving businesses, attorneys, and insurers nationwide. Our examiners include former law enforcement forensic examiners who have testified as court qualified expert witnesses in state and federal proceedings. We do not sell security software and we do not manage client networks, so our findings carry no conflict of interest when the question is whether an environment was adequately secured.
Every engagement follows documented chain of custody, defensible acquisition methods, and reporting written for attorney review, insurer submission, regulator response, or courtroom use. Work performed at the direction of counsel is generally treated as attorney work product prepared in anticipation of litigation. Call (833) 292-3733 or request a confidential consultation.
Disk evidence shows what files existed and what likely executed, but it cannot show injected code, decrypted credentials, or malware that ran entirely in memory. Memory forensics fills that gap and often changes the understanding of how an intrusion actually unfolded.
The original memory contents cannot be recovered after reboot. Depending on system configuration, a hibernation file or pagefile may retain partial evidence, and the investigation shifts more heavily toward disk, log, and network evidence.
It is a widely used open source framework for analyzing memory images, capable of extracting running processes, network connections, and evidence of code injection. Its broad adoption and transparent methodology make its output well suited to scrutiny in legal and regulatory contexts.
In some cases, if memory is captured while the ransomware process is still active, encryption keys or related artifacts may be recoverable. This depends heavily on the specific ransomware family and the timing of capture.
It can be done safely by an examiner following an established methodology, though it does require running an acquisition tool on the live system, which should be done deliberately and documented as part of the forensic process.
Often yes, either through provider level snapshot features that include memory state or through in guest capture tools run before the instance is stopped or terminated, though the specific approach depends on the cloud platform.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder