Internship← Digital Forensics learning pathDigital Forensics · Module 8 of 10
Network and memory forensics
Analyse traffic and RAM for evidence.
📖 Key ideas
- Network forensics analyses packet captures and logs.
- Tools: Wireshark, Zeek, NetworkMiner.
- Memory forensics analyses RAM dumps for running processes and connections.
- Volatility is a popular memory analysis framework.
- Logs from firewalls, proxies and servers fill gaps.
💡 Real-life example: Memory forensics is a snapshot of a busy kitchen at one moment: what's on every burner right now.
PCAPPacket capture file
WiresharkPacket analyser
VolatilityMemory forensics framework
RAM dumpCopy of memory contents