Skip to main content
ENID

Security & DFIR

DFIR Windows 11 Volatile Memory Forensics & Volatility 3 Analysis

Live volatile RAM acquisition and deep kernel memory analysis on a Windows 11 host system to detect unlinked processes, inspect handles, and carve active memory artifacts.

Open GitHub Repository View Visual Evidence (6)
DFIR Windows 11 Volatile Memory Forensics & Volatility 3 Analysis

System Implementation & Approach

Acquired 10 GB physical RAM via FTK Imager v8.3 with ring-0 kernel driver isolation. Conducted Volatility 3 analysis via dynamic Microsoft PDB symbol resolution (Build 26100), DKOM unlinked process detection via psscan, VAD PAGE_EXECUTE_READWRITE scanning via malfind, and in-memory DOCX carving via dumpfiles.

Role & Contribution

Individual forensic examiner: captured physical RAM dump, configured Volatility 3 Python framework, analyzed Windows 11 kernel paging structures, recovered terminated processes, and verified in-memory carved files.

Key Implementation Highlights

  • Captured live physical RAM non-destructively to Drive D without pagefile contamination.
  • Resolved Windows 11 Build 26100 kernel base (0xf803b8600000) and DTB (0x1ae000) via dynamic symbol tables.
  • Carved in-memory file objects directly from physical offset 0xca8ea9f85350 with validated ZIP magic bytes.

Verification & Outcomes

  • 10.72 GB raw physical RAM capture verified intact on disk (memdump.mem).
  • Successful in-memory file carving of Tugas_06.docx with valid PK header bytes.
  • Identified unlinked terminated processes and verified FTK Imager kernel driver handles.