Volatility 3 内存取证分析

---
name: memory-analysis
description: Analyze Windows memory images on a SANS SIFT workstation with Volatility 3 and Memory Baseliner, covering process, network, registry, service, injection, module, file extraction, strings, timeline, and baseline-difference workflows while preserving forensic read-only handling.
---

# Memory Analysis

Use this skill when examining Windows memory captures on a SANS SIFT workstation. Treat the evidence image as read-only, record the image hash before analysis, keep generated output under the case analysis/export directories, and use UTC for timeline work.

## Environment

Primary tools:

- Volatility 3: `/opt/volatility3-2.20.0/vol.py`
- Memory Baseliner: `/opt/memory-baseliner/baseline.py`

Do not confuse `/usr/local/bin/vol.py` with the Volatility 3 path above. Volatility 3 may need Microsoft symbol data; use cached symbols or `--offline` when the workstation cannot reach the symbol source.

A convenient session setup is:

```bash
alias vol="/opt/volatility3-2.20.0/vol.py"
mkdir -p ./analysis/memory ./exports/dumpfiles ./exports/malfind ./exports/memdump
```

Use elevated privileges only when a plugin or evidence location actually requires them.

## Core workflow

### 1. Identify the image and operating-system context

```bash
file <image.img>
vol -f <image.img> windows.info
```

If symbol loading hangs, retry with `--offline` and document the limitation.

### 2. Enumerate and correlate processes

Run more than one process-enumeration method so hidden or terminated processes are not missed.

```bash
vol -f <image.img> windows.pslist > ./analysis/memory/pslist.txt
vol -f <image.img> windows.psscan > ./analysis/memory/psscan.txt
vol -f <image.img> windows.pstree > ./analysis/memory/pstree.txt
vol -f <image.img> windows.cmdline > ./analysis/memory/cmdline.txt
vol -f <image.img> windows.envars > ./analysis/memory/envars.txt
```

Investigate anomalies such as unexpected parent/child relationships, system processes outside normal paths, orphaned processes, short-lived processes, suspicious command lines, and unusual privilege assignments.

For a specific PID:

```bash
vol -f <image.img> windows.getsids --pid <PID>
vol -f <image.img> windows.privs --pid <PID>
vol -f <image.img> windows.dlllist --pid <PID>
vol -f <image.img> windows.handles --pid <PID>
```

### 3. Review network activity

```bash
vol -f <image.img> windows.netstat > ./analysis/memory/netstat.txt
vol -f <image.img> windows.netscan > ./analysis/memory/netscan.txt
```

`netstat` is useful for structures representing active connections at capture time; `netscan` can also recover historical or closed connections. Correlate external addresses with owning PIDs, process command lines, executable paths, and disk artifacts before treating an address as malicious.

### 4. Review services, registry and persistence indicators

```bash
vol -f <image.img> windows.svcscan > ./analysis/memory/svcscan.txt
vol -f <image.img> windows.registry.hivelist > ./analysis/memory/hivelist.txt
vol -f <image.img> windows.registry.userassist > ./analysis/memory/userassist.txt
```

For targeted registry work:

```bash
vol -f <image.img> windows.registry.printkey --key "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
vol -f <image.img> windows.registry.printkey --key "SYSTEM\\CurrentControlSet\\Services"
```

### 5. Hunt for injection and hidden kernel components

```bash
vol -f <image.img> windows.malfind > ./analysis/memory/malfind.txt
vol -f <image.img> windows.vadinfo --pid <PID> > ./analysis/memory/vadinfo_<PID>.txt
vol -f <image.img> windows.modules > ./analysis/memory/modules.txt
vol -f <image.img> windows.modscan > ./analysis/memory/modscan.txt
```

Treat `malfind` hits as leads rather than proof. JIT runtimes and other legitimate software can create suspicious-looking memory regions. Compare `modules` and `modscan` for unlinked or hidden drivers and validate findings with additional evidence.

YARA may be applied to process VAD regions when a suitable rule exists:

```bash
vol -f <image.img> windows.vadyarascan --pid <PID> --yara-rules /path/to/rules.yar
```

### 6. Extract files or process memory for deeper analysis

```bash
vol -f <image.img> windows.filescan > ./analysis/memory/filescan.txt
vol -f <image.img> windows.dumpfiles --virtaddr <VIRTUAL_ADDRESS> --output-dir ./exports/dumpfiles/
vol -f <image.img> windows.pslist --dump --pid <PID>
vol -f <image.img> windows.memmap --dump --pid <PID> --output-dir ./exports/memdump/
```

Extract strings from a dumped process and pivot on commands, URLs, UNC paths, encoded content, or tool names:

```bash
strings -a -n 8 ./exports/memdump/pid.<PID>.dmp > ./analysis/memory/strings_<PID>_ascii.txt
strings -a -el -n 8 ./exports/memdump/pid.<PID>.dmp > ./analysis/memory/strings_<PID>_unicode.txt
```

Hash every extracted executable or blob before further handling.

### 7. Build a memory timeline

```bash
vol -f <image.img> timeliner --create-bodyfile > ./analysis/memory/mem_bodyfile.txt
mactime -b ./analysis/memory/mem_bodyfile.txt -z UTC > ./analysis/memory/mem_timeline.txt
```

Use the memory timeline as corroboration and correlate it with filesystem, event-log and Plaso timelines.

## Memory Baseliner

Use Memory Baseliner when a known-good baseline is available or when a baseline can be created from a clean reference image.

Compare processes, drivers and services:

```bash
python3 /opt/memory-baseliner/baseline.py -proc -i <suspect.img> --loadbaseline --jsonbaseline <baseline.json> -o ./analysis/memory/proc_baseline.csv
python3 /opt/memory-baseliner/baseline.py -drv  -i <suspect.img> --loadbaseline --jsonbaseline <baseline.json> -o ./analysis/memory/drv_baseline.csv
python3 /opt/memory-baseliner/baseline.py -svc  -i <suspect.img> --loadbaseline --jsonbaseline <baseline.json> -o ./analysis/memory/svc_baseline.csv
```

Create a new baseline only from a trusted reference image:

```bash
python3 /opt/memory-baseliner/baseline.py -proc -i <clean.img> --savebaseline --jsonbaseline <baseline.json>
```

Useful comparison dimensions include import hash, owner, command line and process state. Investigate unique processes, DLLs, drivers or services rather than assuming every difference is malicious.

## Recommended analysis order

1. Verify image and OS context.
2. Compare `pslist`, `psscan` and `pstree`.
3. Review command lines, environment, SIDs and privileges.
4. Correlate `netstat`/`netscan` with process ownership.
5. Inspect services, registry and persistence traces.
6. Use `malfind`, VAD analysis and module comparisons for injection/rootkit leads.
7. Dump and hash suspicious material.
8. Compare against a trusted baseline when available.
9. Correlate memory findings with disk and timeline evidence.

## Output discipline

Keep textual analysis under `./analysis/memory/`, extracted evidence under `./exports/`, and record command failures or missing symbols explicitly. Never treat a single plugin result as conclusive when another independent artifact can corroborate it.