Day 11 | Memory Forensics: When Shutting Down a Computer Can Destroy Critical Evidence

Centre for Police Technology Launches a 31-Day Cybersecurity Knowledge Series for Police, LEAs, Corporate Investigators, Digital Forensics, Fraud, Cyber Risk and Security Professionals

Day 11 of the Centre for Police Technology (CPT) 31-Day Cybersecurity Knowledge Series explores how memory forensics helps investigators uncover hidden threats, reconstruct cyber incidents and preserve evidence that may otherwise be lost.

1. What Is Memory Forensics?

When a computer is switched off, much of the information stored in its active memory disappears. Yet, during a cyberattack, that temporary data may contain some of the most valuable clues investigators need to understand what happened.

Memory forensics involves acquiring a snapshot of a system’s RAM and analysing it for evidence of suspicious or malicious activity.

Because RAM is volatile, its contents can change rapidly and are generally lost when the system loses power. This makes the timing and method of evidence collection critical.

Memory analysis can help investigators identify processes that were running, suspicious code loaded into memory, active connections to external systems, injected code, command-line activity and other traces of compromise. It can also help identify evidence of malware that operates primarily in memory rather than relying on traditional files.

However, memory captures are snapshots of a changing system, not complete records of everything that happened. Findings must be interpreted alongside other evidence, including system logs, disk images and network records.

2. How Do Criminals Exploit Memory?

Cybercriminals increasingly use techniques designed to evade conventional security tools and leave fewer traces on disk.

Common examples include:

• Fileless malware: Malicious activity that relies heavily on legitimate system tools or code executed in memory.
• Process injection: Hiding malicious code within the memory space of a legitimate process.
• Credential theft: Attempting to extract authentication material or other sensitive information from memory.
• Ransomware: Running malicious processes and, in some cases, obtaining encryption-related material during an attack.
• Remote access and command execution: Using compromised systems to communicate with attacker-controlled infrastructure while disguising activity as legitimate processes.

These techniques do not always leave clear evidence in ordinary files or logs. Memory forensics can provide additional visibility into what was active on a system at a particular point in time.

FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals

3. How Can Law Enforcement Use Memory Forensics?

For cybercrime investigators, memory forensics can help answer questions that traditional evidence collection may not fully resolve.

It can assist in identifying suspicious processes, examining malware behaviour, discovering active network connections and investigating possible credential theft. In certain cases, memory analysis may also help reveal injected code or fragments of attacker activity that support the reconstruction of an incident.

Effective investigations require a disciplined approach:

• Capture evidence promptly: Volatile data may disappear or change as the system continues operating.
• Document every action: Record the system state, collection time, tools used and steps taken during acquisition.
• Preserve integrity: Store the acquired memory image securely and calculate appropriate cryptographic hashes to help verify that the evidence has not changed.
• Maintain chain of custody: Document who collected, accessed, transferred and examined the evidence.
• Corroborate findings: Compare memory artefacts with disk evidence, security logs, network records and other relevant sources.

Memory acquisition itself can alter a system’s state. Investigators should therefore follow approved procedures and use trained personnel, particularly when dealing with live systems or critical infrastructure.

4. What Should Individuals Do?

Most people will not need to conduct memory analysis themselves. However, they can take practical steps to reduce the risk of compromise and avoid destroying useful evidence if an incident occurs.

• Keep operating systems, browsers and security software updated.
• Use multi-factor authentication and strong, unique passwords.
• Avoid suspicious links, unexpected attachments and untrusted downloads.
• Pay attention to unusual device behaviour, unexpected applications or suspicious login alerts.
• If a serious cyber incident is suspected, document what you observe and contact the relevant IT or cybersecurity support team.

If a device may be involved in a significant cybercrime or security incident, avoid casually restarting or switching it off before receiving appropriate guidance. Doing so can destroy volatile evidence. At the same time, immediate containment may be necessary if the device poses an active security risk, so decisions should be guided by trained responders.

5. What Should Companies Put in Place?

Organisations should treat memory forensics as part of a broader incident-response capability rather than an emergency measure improvised during an attack.

Key protections include:

• Incident-response procedures: Define when and how memory acquisition should be performed, including who is authorised to collect evidence.
• Trained response teams: Ensure personnel understand volatile evidence, safe acquisition methods and forensic limitations.
• Endpoint monitoring: Use appropriate endpoint detection and response tools to identify suspicious processes and activity.
• Evidence preservation: Maintain secure storage, access controls, reliable timestamps and documented chain-of-custody procedures.
• Regular readiness exercises: Test whether teams can preserve and analyse relevant evidence under realistic incident conditions.
• Coordinated investigation: Integrate memory analysis with endpoint logs, network telemetry, identity records and disk forensics.

Not every incident requires a memory dump, and collecting one may involve privacy, operational and legal considerations. Organisations should establish clear procedures before an incident occurs.

What’s New? AI-Powered Memory Forensics

Memory forensics is evolving with AI-assisted analysis and automated malware detection. Emerging tools such as MemoryInvestigator combine AI with Volatility 3 to support memory-analysis workflows, while platforms such as Volexity Volcano help investigators examine memory artefacts more efficiently.

These technologies can help identify fileless malware, suspicious processes and hidden traces of cyberattacks. However, investigators must still verify findings and preserve evidence integrity.

The goal: faster investigations without compromising forensic accuracy.

Memory forensics helps investigators examine what a system was doing while it was running not just what remains after an incident. In attacks involving fileless malware, process injection or credential theft, that temporary evidence can provide crucial investigative leads.

When digital evidence can disappear with a shutdown, the ability to capture and interpret memory before it is lost can make a significant difference to a cybercrime investigation.

Day 11 — Memory Forensics
31 Days | 31 Key Topics | October 2026
Cybersecurity Awareness Month Knowledge Initiative

Created by Centre for Police Technology (CPT)

Follow Centre for Police Technology (CPT) for the complete 31-Day Cybersecurity Knowledge Series.