awesome-memory-forensics
github.com/digitalisx/awesome-memory-forensics ↗A curated list of awesome Memory Forensics for DFIR
Use this list with your AI agent
Add the Context Awesome MCP server to Claude, Cursor, or any MCP client, then ask:
"Show me writeups resources from awesome-memory-forensics"
Installation instructions →What's inside
Course
- 13Cubed Investigating Windows Memory
Self-paced Windows memory forensics course covering Volatility, MemProcFS and WinDbg.
- A Complete Practical Approach To Malware Analysis And Memory Forensics - 2022 Edition
2022 Edition
- Malware and Memory Forensics Training
- Malware and Memory Forensics Training on Volatility 3 (2024)
The first official in-person training focused solely on Volatility 3, taught by the core developers.
- SANS FOR508
Advanced Incident Response, Threat Hunting, and Digital Forensics, including a memory forensics section.
Articles
- 13Cubed Linux Memory Forensics ChallengeWriteUps
- 13Cubed Windows Memory Forensics ChallengeWriteUps
- A New Tool to Detect Known Malware from Memory Images – impfuzzy for Volatility –JPCERT
- Announcing the Official Parity Release of Volatility 3!Volatility Foundation
- A Volatility Plugin Created for Detecting Malware Used in Targeted AttacksJPCERT
- eBPF rootkits and the Volatility blind spot in Linux memory forensicsBlogs
Challenges
Papers
- About the applicability of Apache2 web server memory forensicsDFRWS APAC 2023
- A Comprehensive Quantification of Inconsistencies in Memory DumpsRAID 2025
- Advanced Monero Wallet Forensics: Demystifying Off-Chain Artifacts to Trace Privacy-Preserving Cryptocurrency TransactionsDFRWS APAC 2025
- AI Psychiatry: Forensic Investigation of Deep Learning Networks in Memory ImagesUSENIX Security 2024
- All Your TLS Keys Are Belong to Us: A Novel Approach to Live Memory Forensic Key ExtractionDFRWS APAC 2025
- An OS-agnostic Approach to Memory ForensicsNDSS 2023
Videos
- Amazon AWS EC2 Forensic Memory Acquisition - LiMEDFIR Science
LiME
- A New(ish) Way to Detect Process Hollowing13 Cubed
- Automate Volatility 3 Memory Analysis with This Tool13 Cubed
- Defeating EDR Evading Malware with Memory ForensicsDEF CON 32
- Detecting & Defeating EDR-Evading Malware with Volatility 3 (2024)Volatility Foundation (FTSCon)
- Detecting Persistence in Memory13 Cubed
Tool
- AVMLMemory Acquisition
X86_64 userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary.
- BPFVol3Memory Acquisition
Volatility 3 plugins to extract and analyze Linux eBPF programs, maps and links for detecting BPF-based malware. (1st place, 2023 Volatility Plugin Contest)
- btf2jsonMemory Acquisition
Generates Volatility 3 symbol tables from the kernel's BTF type information, without needing a debug kernel or dwarf2json. (1st place, 2024 Volatility Plugin Contest)
- Digital CollectorMemory Acquisition
A powerful forensic imaging software solution to perform triage, live data acquisition and targeted data collection for Windows and Mac computers. (Formerly BlackBag MacQuisition)
- dwarf2jsonMemory Analysis
Go utility that processes files containing symbol and type information to generate Volatilty3 Intermediate Symbol File (ISF) JSON output suitable for Linux and macOS analysis.
- ETW ScanMemory Acquisition
JPCERT/CC Volatility 3 plugin that recovers Event Tracing for Windows (ETW) events from memory images.
Datasets
- CIC-MalMem-2022
Obfuscated malware memory dataset (spyware, ransomware, trojan) from the Canadian Institute for Cybersecurity.
- Digital Corpora
Daily RAM images from the M57-Patents scenario.
- MemLabs
- NIST
- The Art of Memory Forensics
- Volatility Memory Samples
Index of public Windows, Linux, macOS and Android memory images.
Books
- Practical Memory Forensics
Jumpstart effective forensic analysis of volatile memory.
- The Art of Memory Forensics
Detecting Malware and Threats in Windows, Linux, and Mac Memory.
Showing a sample of 191 resources. View the full list on GitHub →