Memory forensics is an investigative technique that involves finding and extracting raw forensic artifacts from computer RAM (Monnappa, K. A. 2018). The RAM stores valuable information about the runtime status of a system. Hence, acquiring a memory dump is crucial in revealing important information during an investigation exercise. It provides details on the existing network connection, registry hive modifications, process handles, loaded modules as well as kernel drivers, among others.  For a long time, the Random Access Memory was overlooked as a bane for forensic artifacts, most forensic analysts  focused their investigation solely on the  evidence in the hard drive (Johansen, G. 2017). 

In recent times, memory forensics has become a valuable investigative technique during digital forensics and incident response. According to Monnappa, K. A. (2018), it can also be used to complement malware analysis by helping to gain proper context into the malware behavior post-infection. In the wave of changing technological disruption, memory forensics has become more challenging as the operating systems, software, and hardware architectures keep evolving. However, there is always room to level up your skills and expertise despite the rapid technological advancement. Importantly, an understanding of the basics of the fundamentals is always a step in the right direction. 

This article will provide insights on how to better prepare for memory forensic investigation by touching on memory forensics methodology, customizing a toolkit manager, and reviewing the current challenges in memory forensics.

Methodology for Memory analysis

While....