re-forensics

Memory Forensics and Threat Intelligence

Complete Workflow

1. Dump source: default dump first — first confirm whether a ready-made dump exists.Route by forensics level: full-machine image (LiME/AVML/crash dump, etc., parseable by Volatility) → memory forensics branch; process-level gcore the artifact is a single-process ELF core (no kernel structures, not parseable by Volatility full-machine plugins) → only process-level review (gdb/eu-stack, see [[re-memdump]] (capability:memory-dump) step 3), do not enter [[re-mem-forensics]] (capability:memory-forensics). Dumping is performed per [[re-memdump]] (capability:memory-dump) (dump timing is determined by plaintext/code materialization — for a single-layer packer, near the real OEP is usually suitable; OEP is not a universal criterion; before dumping, filter by /proc/<pid>/maps filter [vsyscall]/[vdso], see the "direct read vs dump" decision table and the Linux memory dump extreme section in [[re-analyze/platform-tips]])
2. Memory forensics: [[re-mem-forensics]] (capability:memory-forensics) — confirm dump source and architecture → process list (pslist) → network connections (netscan) → injection/anomalies (dlllist/malfind) → credential clues (hashdump/lsadump) and suspicious object extraction
3. Clue extraction: organize clues from memory forensics artifacts — suspicious processes/injection addresses/network callbacks/credential hashes/extracted objects (modules, shellcode, plaintext keys), record the evidence path and timestamp for each item (forensics requires traceability, see [[re-analyze/platform-tips]])
4. Intelligence correlation: [[re-ti]] (capability:threat-intel) — use hashes/domains/IPs from the clues to query VirusTotal / Any.run / hybrid-analysis, correlate family and threat group, and put the results into the IOC list and report of [[re-ioc]] (capability:threat-intel)

Archive each step's artifacts (dump, plugin output, extracted objects) by sha256 + path, for reference by the report and [[re-ioc]] (capability:threat-intel).

When to Use Which Atomic Skill (Selection Tree)

Branch by input characteristics/objective:

• A dump already exists or the process is already dead (has .raw/.mem/.core) → [[re-mem-forensics]] (capability:memory-forensics; process/network/injection/credential clues)
• No dump, need to acquire on site → first [[re-memdump]] (capability:memory-dump; default dump first) → back to [[re-mem-forensics]] (capability:memory-forensics）
• Need to look up sample background ("what is this hash/domain/IP" "which family") → [[re-ti]] (capability:threat-intel；VT/Any.run/hybrid-analysis/MISP）
• Disk/file system forensics (deleted-file recovery, timeline, suspicious file location) → [[re-disk-forensics]] (capability:disk-forensics; disk-side forensics, parallel to the memory side of [[re-mem-forensics]] (capability:memory-forensics))
• After memory analysis finds suspicious objects/callbacks and needs deeper investigation → suspicious modules/shellcode go to [[re-binary-core]] (capability:decompilation、debugging、memory-dump、elf-parser、pe-parser、macho-parser; [[re-ghidra]] (capability:decompilation、debugging) / [[re-ida]] (capability:decompilation、debugging) static); callback behavior verification goes to [[re-malware]] (capability:malware-behavior、document-malware、evasion-analysis、key-extraction、threat-intel; sandbox)
• Only static file analysis, no memory involved → not this gateway, forward to [[re-binary-core]] (capabilities:decompilation、debugging、memory-dump、elf-parser、pe-parser、macho-parser) / [[re-malware]] (capabilities:malware-behavior、document-malware、evasion-analysis、key-extraction、threat-intel）
• Container images (image tars exported by docker save/skopeo) → "Container Image Forensics" section below

Container Image Forensics

• Image structure: tar archive + layers (each layer = filesystem snapshot diff;docker save / skopeo copy export)
• Layer extraction: unpack layer archives → layer-by-layer filesystem analysis (reuse methods from [[re-disk-forensics]] / [[re-fw-rootfs]]: file enumeration, deleted file recovery)
• Analysis focus: configuration and secrets (environment variables, mount points, entrypoint/CMD scripts), residual artifacts in historical layers (deleted files are still recoverable in old layers), malicious image determination (startup commands, network behavior, suspicious binaries)
• Output: image content inventory + suspicious item list (links up with indicator extraction in [[re-ioc]])

Cross-domain correlation

• This gateway is referenced by the [[re-malware]] deep analysis path—when memory residue (injections, in-memory payloads, credentials) needs to be checked after behavior analysis, forward to [[re-forensics]]; intelligence correlation results are returned to [[re-malware]] to corroborate family determination
• Disk-side forensics [[re-disk-forensics]] and memory-side [[re-mem-forensics]] are parallel—disk evidence (deleted files/timeline) and memory evidence (processes/network/credentials) corroborate each other
• Dump artifacts come from [[re-memdump]] (default dump takes priority, see [[re-analyze/platform-tips]])
• Intelligence linkage with [[re-ioc]]—query results from [[re-ti]] and clues from [[re-mem-forensics]] are summarized into an IOC list and report
• Deep dive into suspicious objects (extracted modules/shellcode) → [[re-binary-core]] ([[re-ghidra]] / [[re-ida]] decompilation)
• This gateway is invoked by the triage "memory forensics / intelligence query" path of [[re-analyze]]

Common pitfalls and traps

• Skipping dump source confirmation and running analysis directly → tools and dump architecture mismatch, everything goes wrong—first confirm the source with [[re-memdump]], and obtain a complete dump with default dump priority per [[re-analyze/platform-tips]]
• Dump is polluted by vsyscall/vdso junk pages → biased analysis results—extreme segments must be filtered before dumping ([[re-analyze/platform-tips]] Linux memory dump extreme segments)
• Forensics results without a chain of custody → report is not reproducible—archive each step's artifacts (path + sha256 + timestamp)
• Reaching conclusions from memory clues without reporting for verification → misjudgment—statically deep dive into suspicious objects first ([[re-binary-core]]), and verify background through [[re-ti]] with multiple confirmations