Whether you use memory forensics as part of the incident response or for malware analysis, the following are the general steps in memory forensics:
- Memory Acquisition: This involves acquiring (or dumping) the memory of a target machine to disk. Depending on whether you are investigating an infected system or using memory forensics as part of your malware analysis, the target machine can be a system (on your network) that you suspect to be infected, or it could be an analysis machine in your lab environment where you executed the malware sample.
- Memory Analysis: After you dump the memory to disk, this step involves analyzing the dumped memory to find and extract forensic artifacts.