Extract and analyze forensic artifacts from memory dumps - passwords, tokens, encryption keys, browser data.

Memory Artifacts

Once you've done the basic Volatility analysis (process list, command history, file scan), the next step is extracting specific artifact types: credentials, browser history, clipboard contents, encryption keys, and more. These are the artifacts that often contain the flag or provide the missing piece of an investigation.

This page assumes you're comfortable with Volatility basics. If not, read Memory Forensics with Volatility first.

Artifact Overview

Credentials

# Dump SAM hashes (requires SYSTEM + SAM hives in memory)
vol -f memory.raw windows.hashdump

# Output: username:SID:LM_hash:NT_hash
# Crack NT hash with hashcat:
hashcat -m 1000 nt_hashes.txt /usr/share/wordlists/rockyou.txt

Browser Artifacts

Find browser process PID

vol -f memory.raw windows.pslist | grep -iE "chrome|firefox|msedge|iexplore"

Dump browser process memory

vol -f memory.raw windows.memmap --pid <browser_pid> --dump

Extract URLs and credentials from dump

strings pid.<pid>.dmp | grep -iE "https?://" | sort -u
strings pid.<pid>.dmp | grep -i "password"
strings pid.<pid>.dmp | grep -i "flag{"

Find and extract browser database

vol -f memory.raw windows.filescan | grep -i "history"
vol -f memory.raw windows.dumpfiles --physaddr 0x...

sqlite3 extracted_History .tables
sqlite3 extracted_History "SELECT url FROM urls ORDER BY last_visit_time DESC LIMIT 50;"

Clipboard and Open Files

Registry Artifacts

# List loaded registry hives
vol -f memory.raw windows.registry.hivelist

# Run keys — persistence mechanisms
vol -f memory.raw windows.registry.printkey \
  --key "Software\Microsoft\Windows\CurrentVersion\Run"

# Recently accessed files
vol -f memory.raw windows.registry.printkey \
  --key "Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs"

Malware Detection

# Find injected code / process hollowing
vol -f memory.raw windows.malfind

# YARA scan for specific patterns
vol -f memory.raw windows.yarascan \
  --yara-rules='rule flag { strings: $a = "flag{" condition: $a }'

# Hidden process detection
vol -f memory.raw windows.pslist > pslist.txt
vol -f memory.raw windows.psscan > psscan.txt
diff pslist.txt psscan.txt
# Lines in psscan but not pslist = hidden processes

Linux Memory Artifacts

vol -f memory.raw linux.bash                    # bash history
vol -f memory.raw linux.psenv --pid <pid>       # environment variables
vol -f memory.raw linux.lsof                    # open files
vol -f memory.raw linux.netstat                 # network connections

Direct String Hunting

strings memory.raw | grep "flag{"
strings memory.raw | grep -i "CTF{"

# Windows Unicode
strings -e l memory.raw | grep "flag{"   # UTF-16LE
strings -e b memory.raw | grep "flag{"   # UTF-16BE

# All strings ≥10 chars mentioning interesting terms
strings -n 10 memory.raw | sort -u | grep -iE "(flag|secret|password|key)"

Checklist

strings + grep for flag format — always first
windows.hashdump → crack NT hashes
windows.clipboard → check clipboard
Find notepad/browser PIDs → dump → strings
windows.malfind → injected shellcode
windows.filescan | grep History → browser databases
linux.bash → command history
linux.psenv → environment variables (may contain flags/keys)

Last updated on Aug 1, 2025

Memory Artifacts

Clipboard contents

Notepad / text editor contents

Encryption keys

On this page