🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Incident Response › Lesson 5
TEC-CYBE44-07 · Lesson 5 · 16 clock hours · lab

Memory and Disk Imaging Lab

Objective. Students will perform a live memory capture and a bit-for-bit disk image on a lab virtual machine using industry-standard forensic tools, then verify image integrity with a hash.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Memory and Disk Imaging in Incident Response

When a security incident occurs, the digital evidence you collect may eventually support disciplinary action, civil litigation, or criminal prosecution. For that evidence to be admissible and credible, every step of its collection must follow documented, repeatable procedures. Memory and disk imaging are the two most foundational acquisition tasks in digital forensics, and getting them right from the start protects the investigation and your professional reputation.

Why Collect Memory First

Random-access memory (RAM) is volatile: it disappears the moment power is cut. RAM holds running processes, open network connections, encryption keys, clipboard contents, and malware that may never write itself to disk — a technique called fileless malware. Because of this, live memory capture must happen before anything else, including before you power off or reboot the machine. The order of volatility, established in RFC 3227 and reinforced in standard forensic practice, puts registers and RAM at the top of the collection priority list.

Volatility 3 is the current release of the Volatility Foundation's open-source memory forensics framework. It works with memory dumps in raw, crash-dump, and hibernation-file formats. Key plugins you will use in this lab include `windows.pslist` (list running processes), `windows.netstat` (active network connections), and `windows.malfind` (detect memory regions with injected or suspicious executable code). Volatility does not capture memory by itself — you first dump RAM using a separate acquisition tool such as WinPmem or the built-in feature of FTK Imager, then analyze the resulting file with Volatility.

Bit-for-Bit Disk Imaging

A forensic disk image is an exact, sector-by-sector copy of a storage device, including deleted files, slack space, and unallocated regions that a normal file copy would miss. Two widely used tools in this lab are:

Always image to a write-blocked destination or a verified clean storage medium. A hardware or software write blocker prevents any data from being written back to the evidence drive during acquisition — without one, the act of connecting the drive can alter timestamps or file metadata, contaminating the evidence.

Hash Verification and Chain of Custody

After acquisition, you verify the image by comparing its cryptographic hash to the hash of the source. MD5 produces a 128-bit hash; SHA-256 produces a 256-bit hash. Both are computed automatically by FTK Imager and can be recomputed at any time with tools such as `certutil` (Windows) or `sha256sum` (Linux). If even a single bit differs between the source and the image, the hashes will not match, immediately flagging corruption or tampering.

Hash verification is a legal and procedural requirement for two reasons. First, it provides mathematical proof that the image is identical to the original, satisfying the best-evidence rule in US federal courts (Federal Rules of Evidence, Rule 1002 and related provisions). Second, it anchors the chain of custody: every time the image changes hands, a new hash check confirms it has not been altered. Courts and opposing counsel routinely challenge forensic evidence; an unbroken chain of custody with matching hashes is your strongest defense against those challenges.

The Acquisition Log

The acquisition log is a contemporaneous written record that documents every action taken during evidence collection. At minimum it must include: case number, examiner name and contact information, date and time (with time zone) of acquisition start and end, make/model/serial number of the source device, tool name and version, output file name and location, and the MD5 and SHA-256 hash values of both the source and the acquired image. Incomplete logs can disqualify evidence, so fill in every field before you move to analysis.

Safety and Lab Conduct

This lab uses virtual machines, so there is no electrical hazard from physical hardware. However, treat all lab evidence as if it were real: do not share lab VM credentials outside the class, do not connect lab VMs to production networks, and do not store forensic images on shared or personal cloud storage. Data handling errors in training create bad habits for real investigations. Follow your instructor's directions for sanitizing lab storage media after the exercise is complete.

Lab Workflow Summary

1. Snapshot the Windows lab VM before any acquisition step so the environment can be restored.

2. Acquire RAM using FTK Imager's memory capture feature; save the dump file to your USB drive.

3. Run Volatility 3 against the dump using `pslist`, `netstat`, and `malfind`; record findings.

4. Image the virtual disk using FTK Imager or Autopsy; record MD5 and SHA-256 hashes.

5. Recompute hashes on the saved image and compare to the acquisition report.

6. Complete all fields in the acquisition log template and submit with your hash output screenshots.

Key terms9

Volatile EvidenceDigital data that is lost when power is removed, such as the contents of RAM, running processes, and active network connections; must be collected first according to the order of volatility.
Order of VolatilityA prioritized sequence for evidence collection that captures the most transient data (registers, RAM) before less transient data (disk, logs), as described in RFC 3227 and standard forensic guidance.
Forensic ImageA sector-by-sector, bit-for-bit copy of a storage device that captures all data including deleted files, slack space, and unallocated regions; distinct from a simple file copy.
Write BlockerA hardware device or software control that allows data to be read from an evidence drive while preventing any writes to it, preserving the integrity of the original evidence.
Hash (Cryptographic)A fixed-length output produced by a hash algorithm (such as MD5 or SHA-256) that uniquely represents the content of a file; any change to the file produces a completely different hash.
Chain of CustodyA documented record tracking who collected, handled, transferred, and stored evidence at every point in time, ensuring the evidence has not been tampered with.
Fileless MalwareMalicious code that executes entirely in memory and does not write a persistent file to disk, making it detectable only through memory forensics rather than traditional file scanning.
Volatility 3The current release of the open-source Volatility Foundation memory forensics framework, used to analyze memory dumps by running plugins that extract processes, network connections, and suspicious code regions.
Acquisition LogA contemporaneous written record created during evidence collection that documents case details, examiner identity, timestamps, device identifiers, tool versions, and hash values for both source and image.
In class: Use Volatility Foundation's Volatility 3 to capture and analyze a memory dump from a Windows lab VM: identify running processes, network connections, and injected code artifacts. · Use Autopsy or FTK Imager (free edition) to create a forensic image of a provided virtual disk, generate MD5 and SHA-256 hashes, and document the acquisition in a written acquisition log. · Compare the acquired image hash to the hash of the original disk to confirm integrity, then write a two-paragraph summary explaining why hash verification is a legal and procedural requirement.
Materials: Volatility 3, Autopsy (open-source), FTK Imager Lite, lab VMs (Windows 10/11), USB drives for image storage, acquisition log template
Check: Instructor reviews acquisition log and hash verification output; image hash must match original and log must contain all required fields; pass = all fields complete and hashes match.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Incident Response / Digital Forensics
1. A forensic examiner connects a suspect hard drive directly to a Windows workstation without a write blocker and begins imaging. What is the primary problem with this approach?
Incident Response / Digital Forensics
2. According to the order of volatility, which data source should be collected FIRST during a live-system investigation?
Incident Response / Digital Forensics
3. An examiner uses FTK Imager to create a forensic image and records the MD5 hash as part of the acquisition. Later, an independent verifier recomputes the MD5 hash of the image and gets a different value. What does this indicate?
Threat and Vulnerability Management
4. Which Volatility 3 plugin is BEST suited to detect memory regions that contain injected executable code in a Windows process?
Incident Response / Digital Forensics
5. Why is SHA-256 preferred over MD5 when hashing forensic evidence for legal proceedings?
Incident Response
6. A memory dump analysis with Volatility 3 shows a process called 'svchost.exe' making outbound connections to an external IP address on port 4444. Which step should an analyst take NEXT?
Incident Response / Digital Forensics
7. Which of the following fields is REQUIRED in a forensic acquisition log?
Incident Response / Digital Forensics
8. A junior analyst argues that a simple file copy of the contents of a suspect hard drive is sufficient for forensic purposes. What is the most significant flaw in this argument?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →