Lab — Memory
Pack Volatility, process artifacts, and memory-order checklists — memory literacy file from $DFIR_LAB only.
Visual · t26_memory_lab
Lab: memory pack. $DFIR_LAB only. Original Cyberlium.
Memory pack ties Volatility literacy to volatile-first order — paperwork before network/logs module.
Lessons 5-1–5-3 named Volatility workflow, process artifacts, and memory order. This lab merges Volatility card, process glossary, and order checklist with dump exhibit ID and hash stub. No unauthorized live capture — memory literacy paperwork acceptable. Next: Quiz — Memory Literacy.
1. Lab contract: memory pack
Create $HOME/cyberlium-lab/t26-m05-l04-memory-lab.txt merging Volatility card, process glossary, and memory-order checklist with $DFIR_LAB dump reference.
Optional: run one Volatility plugin on practice dump inside lab VM — log plugin name and UTC time only in notes.
Command guide
Try these commands — Lab contract: memory pack
═══ LINUX / FORENSICS (Volatility 3 Syntax) ═══
List active processes from raw memory dump
Command — copy this
python3 vol.py -f memory.raw windows.pslist
Scan for hidden injected code in process memory
Command — copy this
python3 vol.py -f memory.raw windows.malfind
Enumerate network sockets from memory capture
Command — copy this
python3 vol.py -f memory.raw windows.netscan
Primary tools to practice this lesson: grep, python3. Reference sites: Live response literacy (https://www.sans.org/cyber-security-skills/digital-forensics/); Volatility (https://volatility3.readthedocs.io/); RFC 3227 (https://www.rfc-editor.org/rfc/rfc3227). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for live capture commands against stranger hosts, credential paste blocks, fabricate process — remove. Pack stays literacy.
Link memory exhibit to CoC if separate from disk image.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Network and Logs.
Memory literacy feeds PCAP and log correlation in M6.
4. What you ship: memory literacy pack for $DFIR_LAB
Merged Volatility, process, order sections. $DFIR_LAB named. NO unauthorized capture. chmod 600.
5. What you record before the next lesson
Date. Memory pack path. $DFIR_LAB named. File t26-m05-l04-memory-lab.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Include live winpmem steps against neighbor PC. Fabricate cmdline in report template.
- Right: Write YOUR memory pack for $DFIR_LAB. chmod 600. Next: Quiz — Memory Literacy.
Mission: freeze YOUR memory pack
1) Merge M5 literacy sections. 2) Link dump exhibit and hash. 3) Confirm zero unauthorized capture steps. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Volatile-first checklist travels to every future incident tabletop.
APPLY: This lab requires:
APPLY: True or False: Memory pack should document volatile-first order.
APPLY: Process glossary in memory pack helps: