Digital › Module 5 › Lesson 4
Lab — Memory
Pack Volatility, process artifacts, and memory-order checklists — memory literacy file from $DFIR_LAB only.
Visual · t26_memory_lab
Lab: memory pack. $DFIR_LAB only. Original Cyberlium.
Opening
Memory pack ties Volatility literacy to volatile-first order — paperwork before network/logs module.
Lessons 5-1–5-3 named Volatility workflow, process artifacts, and memory order. This lab merges Volatility card, process glossary, and order checklist with dump exhibit ID and hash stub. No unauthorized live capture — memory literacy paperwork acceptable. Next: Quiz — Memory Literacy.
1. Lab contract: memory pack
Create $HOME/cyberlium-lab/t26-m05-l04-memory-lab.txt merging Volatility card, process glossary, and memory-order checklist with $DFIR_LAB dump reference.
Optional: run one Volatility plugin on practice dump inside lab VM — log plugin name and UTC time only in notes.
Command guide
Try these commands — Lab contract: memory pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Live response literacy — https://www.sans.org/cyber-security-skills/digital-forensics/ Volatility — https://volatility3.readthedocs.io/ (post-acquisition analysis) RFC 3227 — https://www.rfc-editor.org/rfc/rfc3227
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}live process literacy on YOUR machine — NOT memory dump of strangers
Command — copy this
ps aux | head -15
grep -E 'PID|CMD' <<< "$(ps aux | head -3)"
python3 -c "print('Compare ps aux output to Volatility pslist concept — lab literacy only')"═══ WINDOWS ═══
YOUR lab Windows VM — live process literacy, not RAM dump
Command — copy this
Get-Process | Select-Object -First 15 Id,ProcessName,CPU Write-Output 'Volatility pslist literacy maps to live process listing — authorized dumps only'
Primary tools to practice this lesson: grep, python3. Reference sites: Live response literacy (https://www.sans.org/cyber-security-skills/digital-forensics/); Volatility (https://volatility3.readthedocs.io/); RFC 3227 (https://www.rfc-editor.org/rfc/rfc3227). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for live capture commands against stranger hosts, credential paste blocks, fabricate process — remove. Pack stays literacy.
Link memory exhibit to CoC if separate from disk image.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Network and Logs.
Memory literacy feeds PCAP and log correlation in M6.
4. What you ship: memory literacy pack for $DFIR_LAB
Merged Volatility, process, order sections. $DFIR_LAB named. NO unauthorized capture. chmod 600.
5. What you record before the next lesson
Date. Memory pack path. $DFIR_LAB named. File t26-m05-l04-memory-lab.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include live winpmem steps against neighbor PC. Fabricate cmdline in report template.
Right
Write YOUR memory pack for $DFIR_LAB. chmod 600. Next: Quiz — Memory Literacy.
Mission: freeze YOUR memory pack
1) Merge M5 literacy sections. 2) Link dump exhibit and hash. 3) Confirm zero unauthorized capture steps. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Volatile-first checklist travels to every future incident tabletop.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Memory pack should document volatile-first order.
True or False
Knowledge Check
APPLY: Process glossary in memory pack helps:
Multiple choice