From transient state to active behaviour

Volatile & Network Analysis

Examine memory and network evidence to understand running processes, active connections, injected code, protocols, and communications.

Find my pathStart the foundations

Activityconnected across sources

2analysis routes5practical tools1shared timeline

01

Connect processes to communications

Use both evidence types where possible to test the same explanation.

01ScopeSet the question 02ValidateKnow the capture 03TriageFind useful leads 04CorrelateConnect the evidence 05ReportExplain the finding

Stage 1Define the behaviour in question

Record the host, time window, addresses, users, and suspected behaviour before selecting plugins or filters.

Ask: What observable activity would support or challenge the hypothesis?

02

Choose your evidence path

Start with the captured evidence you have, then correlate with the other source when available.

I have a memory imageI have network evidence

Best matchStart with memory analysis

Examine running state, processes, modules, handles, and connections from a memory image.

Host stateMemory AnalysisInvestigate processes, modules, connections, and in-memory artefacts.Level Intermediate Evidence Memory imageOutcome Explain relevant running or recently active state.CommunicationsNetwork ForensicsInspect packets and network records to reconstruct conversations.Level Beginner to intermediate Evidence PCAP or network recordsOutcome Identify and explain relevant network activity.

03

Build your foundation

Learn what each evidence source represents before choosing analysis techniques.

1

Running stateUnderstanding Memory Analysis

Interpret processes, memory regions, modules, and connections.

2

Network activityUnderstanding Network Forensics

Use packets and metadata to reconstruct communications.

04

Choose a tool by evidence

Select a starting tool based on the image or network data you need to examine.

MEMMemory imagesStructured forensic analysis VFSMemory explorationBrowse a virtual file-system view PCAPPacket capturesProtocols and conversations NETNetwork sessionsMetadata-led investigation

Best starting point for structured memory analysisVolatility and Workbench

Use Volatility capabilities through command-line or graphical workflows to examine memory artefacts.

Also consider MemProcFS for a virtual file-system view or Moneta for focused memory-threat inspection.

Explore Volatility and Workbench

05

Check analysis readiness

Record acquisition and timing context before interpreting transient evidence.

!

Preparation required5 checks remaining.

I verified the evidence integrity and retained the original.I recorded acquisition time, system or sensor context, and known gaps.I defined the host, addresses, and time window relevant to the question.I will record commands, filters, plugins, profiles, and exported results.I will distinguish observed evidence from interpretation.