NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
Process and Network Artifact Analysis
Master memory analysis of processes and network connections. Learn to detect hidden processes, process injection, and extract active sockets using Volatility.
Room tasks
1What Are Process Artifacts and Why Do They Matter
2Process Trees and Parent-Child Relationships
3Analyzing Processes with Volatility
4Extracting Network Connections from Memory
5Guided Lab: Identifying a Suspicious Process in a Memory Dump
Frequently Asked Questions
How do you find hidden processes in a memory image?
Compare plugins like pslist, which walks the active process list, with psscan, which scans raw memory. Processes seen only by psscan may be hidden or terminated.
What network data can memory forensics show?
Memory can reveal active and recently closed connections, listening ports and the owning processes. This ties suspicious traffic to the exact program responsible.
Which tool is used for this memory analysis?
Volatility is the standard open-source framework for it. This intermediate Codelivly room is free and teaches how to apply it to spot hidden processes and network activity.