Review triggering alert
Validate the Sysmon EID 8/10 or EDR injection alert; identify affected host(s), suspicious PIDs, and process names; DO NOT shut down — volatile memory is permanently destroyed
Acquire RAM image with system running
Capture a live RAM image using `winpmem_mini_x64.exe <output.raw>` or DumpIt; live acquisition slightly alters memory due to the running tool — this is an accepted limitation, perform it with the minimum number of steps
Collect pagefile and swapfile
Copy `pagefile.sys` and (Win8+) `swapfile.sys`; these carry paged-out traces and significantly improve `findevil` and inference quality when combined with MemProcFS `-pagefile0`/`-pagefile1` arguments
Ensure evidence integrity
Take SHA-256 hashes before and after acquisition; record tool/version, operator, timestamp, and OS build number (mandatory for Vol3 symbol matching); sign the chain-of-custody form
Image and symbol verification
Validate the OS version/build/kernel base using `python3 vol.py -f image.raw windows.info`; do not proceed to other plugins until the output appears reasonable
Rogue process detection
Compare output from `python3 vol.py -f image.raw windows.pslist` (linked list; misses unlinked processes) and `python3 vol.py -f image.raw windows.psscan` (EPROCESS pool scan; finds unlinked/terminated processes); review parent-child anomalies using `python3 vol.py -f image.raw windows.pstree`
Five-angle check for each process
Verify correct image/executable name, correct path, correct parent, correct command line/arguments, and start time consistency using `windows.cmdline`, `windows.dlllist`, `windows.handles`, and `windows.getsids` plugins
Network artifact analysis
Reveal suspicious IP/port↔PID relationships using `python3 vol.py -f image.raw windows.netscan` and `python3 vol.py -f image.raw windows.netstat`; MemProcFS alternative: `M:\sys\net\netstat.txt` and `netstat-v.txt`
Injected code detection (malfind)
Find regions with RWX permissions + not mapped to disk + containing MZ/shellcode using `python3 vol.py -f image.raw windows.malfind`; extract suspicious regions with `python3 vol.py -f image.raw -o /output/ windows.malfind --dump`; filter out Defender/JIT false positives against the baseline
PEB-VAD inconsistency check
Compare PEB's three DLL lists (InLoad/InMem/InInit) and VAD using `python3 vol.py -f image.raw windows.ldrmodules`; an empty `MappedPath` or a DLL missing from the lists is a sign of reflective injection/hollowing
Process hollowing detection
Automatically scan for hollowed processes using `python3 vol.py -f image.raw windows.malware.hollowprocesses` (formerly `windows.hollowprocesses`, deprecated as of 2026-06-07); use `windows.ptemalfind` (Frank Block, third-party, `github.com/f-block/volatility-plugins`) with PTE ground-truth to catch permission-change evasions
MemProcFS findevil scan
Start MemProcFS with `-forensic 1` or write `1` to `M:\forensic\forensic_enable.txt`; review `PE_INJECT`/`NOIMAGE_RWX`/`PE_NOLINK`/`PEB_MASQ`/`PROC_NOLINK` flags in the `M:\forensic\findevil\` directory; `PE_PATCHED` produces many false positives (.NET/JIT, SysWOW64) — filter using the baseline
Rootkit check (when needed)
If a hidden driver is suspected, run `python3 vol.py -f image.raw windows.ssdt` (suspicious if SSDT entry target is outside `ntoskrnl.exe`/`win32k.sys`), `windows.modules` and `windows.modscan` (finds unlinked drivers via pool-tag scan), and `windows.driverirp`; use Vol2 for `psxview` and `apihooks` (not included in the standard Vol3 distribution)
LSASS access trace check
Search for unusual handle remnants on LSASS (T1003.001) using `python3 vol.py -f image.raw windows.handles --pid <LSASS_PID>`; if found, treat credentials as exfiltrated
