EXTRACTING MEMORY OBJECTS WITH MEMPROCFS/VOLATITILITY3/BSTRINGS: A PRACTICAL GUIDE

Summary from the TLDR InfoSec newsletter

RAM can be a goldmine of real-time data for forensics experts. MemProcFS is a tool that organizes memory data in a virtual file structure that can be browsed and extracted. Volatility is another memory forensics tool that provides advanced capabilities such as advanced memory carving techniques, more detailed malware analysis, and reconstructing deleted or hidden processes. Tools like grep, strings, and bstrings can be used to identify artifacts in memory dumps.