Question 4 of 10Pro Only
Walk me through how you would conduct memory analysis using the Volatility framework to investigate a potentially compromised Windows host.
Sample answer preview
Conducting memory analysis with Volatility follows a structured approach that progressively builds context about the state of the compromised system. Here is the workflow I follow when investigating a potentially compromised Windows host.
Volatility 3pslistpsscannetscanmalfindprocess hollowing