Finding an Attacker in a Snapshot of Memory: RAM Forensics with Redline and Volatility

Every disk-based forensic technique I'd worked through earlier in this series shared one limitation: a disk image only shows what was written to storage. A sophisticated attack often doesn't look like