3 ms·
I work in digital forensics, and running Volatility against the memory (either online or against a memory dump), helps give a far deeper insight and way higher
by dr_zoidberg 11y ago
I work in digital forensics, and running Volatility against the memory (either online or against a memory dump), helps give a far deeper insight and way higher probability at finding viruses than standard "antivirus" software. You can even find Advanced Persistent Threats (APTs) and "unidentified" viruses, because what you look for are the mechanisms by which a virus resides in memory: hidden processes, hooks to system calls, spurious DLLs, etc.
Ever since I learned about memory analysis, I have considered almost every antivirus useless. I do have the Windows Defender antivirus active, but if I have a real doubt, I turn to memory analysis just to be sure (still clean luckily!).