The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory
Michael Hale Ligh, Andrew Case, Jamie Levy, AAron Walters · Wiley · First edition · 2014
Identifier: ISBN 978-1-118-82509-9
Access and status
Cost
Paid
Costs money to buy outright — a book, a licence, a registration.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
Memory acquisition and analysis across Windows, Linux and macOS, written by the people who built Volatility: process and kernel structures, code injection, rootkit detection, registry and event logs recovered from RAM, the GUI subsystem, network state, and case studies.
Who it is for, and when
The reference for why a memory finding means what it means. When you have to explain an unlinked process, a hollowed image, a suspicious handle or an injected thread, the structural reasoning here is what makes the conclusion defensible. Read the Windows chapters first; the Linux and Mac sections are thinner but still the best published treatment.
What it does not cover
Written against Volatility 2.x and Python 2 for Windows 7/8-era kernels, so the commands as printed largely do not run — Volatility 3 replaced the plugin API and syntax. No coverage of modern kernel mitigations, virtualisation-based security, hypervisor-assisted acquisition, or cloud instance memory capture.
Go to the source
Open at wiley.com (opens in a new tab)https://www.wiley.com/en-us/-p-9781118825099
Details
- Type
- Book
- Written for
- AdvancedWorking examinerAdvanced, Working examiner
- Author
- Michael Hale Ligh, Andrew Case, Jamie Levy, AAron Walters
- Publisher
- Wiley
- Version verified
- First edition
- Year
- 2014
- Identifier
- ISBN 978-1-118-82509-9
- Topics
- memory-forensics, malware, windows, linux, macos, incident-response
- Checked at source
Related entries
Volatility 3
FreeAn open-source memory analysis framework that parses RAM images into processes, network state, loaded modules, injected code, registry hives resident in memory, and command history. Volatility 3 is the actively developed line; Volatility 2 is legacy and should not be the basis of new work, though its documentation is still used for plugin comparison.
13Cubed
Partly freeA YouTube channel and companion training site covering Windows, Linux and macOS endpoint forensics, memory analysis and threat hunting. The YouTube videos are free; the on-demand courses on training.13cubed.com are paid.
A community-maintained, machine-readable knowledge base of digital forensic artefact definitions — where an artefact lives and how to collect it — expressed in YAML and licensed Apache-2.0. It is documented at artifacts.readthedocs.io and coordinated through the forensicartifacts Google Group and the Open Source DFIR Slack.
The Volatility Foundation keeps the Volatility Framework — currently Volatility 3 — free and open source on GitHub, with the accompanying project documentation. Separately it endorses instructor-led memory forensics courses; the Foundation's site does not publish prices for those, and the Malware and Memory Forensics class is a commercial offering run through memoryanalysis.net.
A set of eleven numbered DFIR challenges plus additional memory forensics, unallocated-space and Linux cases published by Ali Hadi, each with the scenario and the evidence to work it. Subjects include a breached web server with both disk image and memory dump, Windows user policy violation, alternate data streams, NTFS hidden-file recovery, browser artefacts, a Sysinternals-abuse malware case, encryption, and anti-forensics and data hiding.