8. Memory, Network and Log Forensics

Introduction and Context

Digital investigations rarely succeed through a single evidence source. A disk image may show that a tool was installed, a network capture may show communication with an external host, and a log record may identify the account used. Yet the most decisive evidence is often distributed across volatile memory, packets, network-flow records, DNS activity, authentication events, endpoint telemetry, and centralized logging platforms. The forensic task is to combine these sources into a defensible explanation of what occurred, when it occurred, how the adversary moved, and what information may have been accessed or removed.

This chapter examines three closely related domains: memory forensics, network forensics, and log forensics. Memory provides a contemporaneous view of processes, handles, sockets, credentials, injected code, and other volatile artefacts. Network evidence describes communication between systems, including command-and-control (C2), lateral movement, and exfiltration. Logs provide chronological records of authentication, execution, configuration changes, access, and administrative activity. Each source is incomplete and potentially misleading when interpreted in isolation. Their value increases when investigators correlate them using common identifiers such as timestamps, usernames, process identifiers, hostnames, IP addresses, domains, and cryptographic hashes.

The chapter therefore treats forensic analysis as an evidence-fusion problem rather than a sequence of unrelated technical examinations.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the forensic value and limitations of volatile memory, packet captures, flow records, DNS data, endpoint telemetry, and centralized logs.

2. Identify malicious processes, injected code, suspicious sockets, credential misuse, lateral movement, C2 activity, and possible exfiltration.

3. Apply a structured workflow for preserving, normalizing, correlating, and interpreting heterogeneous evidence.

4. Distinguish observations from inferences and develop defensible investigative hypotheses.

5. Evaluate anti-forensic behaviour, logging gaps, clock inconsistencies, encryption, and other sources of uncertainty.

6. Recommend technically sound, legally defensible, and proportionate investigative and response actions.

The Evidence Landscape

Volatile memory as a record of execution

Volatile memory contains information that may disappear when a system is shut down or a process terminates. It can reveal active and terminated processes, loaded modules, command-line arguments, environment variables, open files, registry-related objects, kernel structures, network connections, clipboard contents, authentication material, and remnants of malicious code. Unlike a disk image, memory can show what was executing at the time of acquisition rather than merely what had been installed.

Memory analysis commonly begins with process enumeration and comparison. Investigators look for processes with implausible parent-child relationships, execution from user-writable or temporary directories, unsigned or anomalous modules, unusual privileges, hidden processes, and discrepancies between operating-system process lists. A process named similarly to a legitimate system process is not automatically malicious; its path, signature, parent, start time, command line, network activity, and memory regions must be assessed together.

Code injection is particularly important. Malware may place executable code in another process, hollow a legitimate process, load a reflective module, or manipulate thread execution. Indicators include executable memory not backed by a normal image file, suspicious thread start addresses, unusual protection changes, and modules that do not appear in standard loader lists. These indicators support a hypothesis but do not alone establish maliciousness, because legitimate security and management tools may also use advanced memory techniques.

Memory acquisition is time-sensitive. The act of acquisition can alter memory, and a running system may continue to change during collection. Investigators should document the tool, version, acquisition time, operator, system state, hashing method, and any actions taken before collection. A memory image must also be interpreted with the correct operating-system version and architecture; otherwise, structures may be misread and false conclusions may result.

Packets, sessions, and flows

A packet capture records network packets, normally including headers and sometimes payloads. It can establish protocol details, application behaviour, sequence, and content when communications are not encrypted. Full packet capture is highly informative but expensive to store, protect, and analyse. It may also contain personal, confidential, or regulated information.

Flow records are summarized communications, commonly represented by source and destination addresses, ports, protocol, start and end times, packet counts, and byte counts. They do not normally reveal payload content, but they support scalable detection of scanning, beaconing, unusual data transfers, and lateral movement. A short, periodic outbound flow to a rare destination may be consistent with C2; a large one-time transfer from a database server may indicate exfiltration or a legitimate backup. Context determines meaning.

Network analysis should distinguish a connection from a session and a session from an activity. A TCP connection to a cloud service is not proof of compromise. Investigators should ask which process initiated it, whether the destination is expected, whether the timing matches user activity, whether the connection repeats at regular intervals, and whether authentication or file-transfer events occurred at the same time.

DNS as an investigative pivot

DNS records connect names, addresses, clients, and time. Useful data includes queried domain, response, record type, resolver, client, response code, time-to-live, and query frequency. DNS can expose newly observed domains, algorithmically generated names, suspicious subdomains, dynamic DNS, unusually long labels, and requests to infrastructure associated with malware.

DNS evidence must be interpreted cautiously. Shared hosting, content-delivery networks, mobile applications, privacy services, and enterprise security products can make reputation-based conclusions unreliable. A domain’s existence in threat intelligence is a lead, not a substitute for evidence. DNS tunnelling may be suggested by high-volume queries, encoded-looking labels, unusual entropy, and excessive TXT or NULL records, but statistical indicators require comparison with the organization’s normal traffic.

Authentication, endpoint, and centralized logs

Authentication records can reconstruct account use and lateral movement. Relevant fields include account, source host, destination host, authentication method, success or failure, time, logon type, and privilege level. A successful interactive logon from a workstation to several servers outside the user’s normal pattern is more significant when paired with remote-service execution or unusual file access.

Endpoint telemetry extends traditional logs by recording process creation, parent process, command line, file modification, registry changes, network connections, script execution, driver loading, and security-control events. It is especially valuable for linking a network connection to the process that created it. Centralized platforms such as security information and event management (SIEM) systems aggregate these records, normalize fields, apply correlation rules, and support search and alerting.

Log absence is not equivalent to event absence. Logging may be disabled, filtered, delayed, overwritten, blocked by a compromised endpoint, or unavailable because the system was offline. Conversely, duplicate forwarding can make an event appear more frequent than it was. Analysts must understand collection architecture, retention, parsing, time zones, and pipeline reliability before drawing conclusions.

A Correlation Framework for Forensic Analysis

A useful investigative model is the event chain:

execution → persistence or discovery → credential use → lateral movement → command and control → collection → exfiltration or impact

This is not a mandatory sequence. Attackers may skip stages, repeat them, or operate in parallel. The model is valuable because it encourages investigators to test relationships between evidence sources.

A practical workflow has six overlapping phases.

Preserve. Identify volatile systems and collect memory, relevant packet captures, flow data, DNS records, and logs before normal operations destroy evidence. Record legal authority, scope, collection time, tool details, and hashes.

Normalize. Convert timestamps to a documented reference standard, distinguish event time from ingestion time, standardize host and account identifiers, and preserve original values. Maintain raw data separately from transformed analytical copies.

Baseline. Establish normal administrative tools, service accounts, scheduled jobs, DNS patterns, backup traffic, remote-access systems, and expected data-transfer volumes. Detection without a baseline produces excessive false positives.

Pivot. Begin with a reliable indicator such as a process hash, suspicious account, domain, socket, or event identifier. Search across hosts and evidence types. For example, a suspicious process in memory can be linked to its parent process, endpoint network event, DNS query, authentication record, and file-access activity.

Construct and test hypotheses. State propositions explicitly: “The workstation was used to obtain credentials and connect to three servers.” Identify expected evidence, search for confirming and disconfirming observations, and assign confidence. A disciplined analyst does not treat the first plausible story as established fact.

Report and act. Preserve reproducibility by documenting queries, filters, assumptions, excluded data, and interpretation. Response actions such as isolation, credential reset, blocking, or reimaging should be proportionate to confidence and business risk.

A timeline is often the central analytical product. It should distinguish at least four times: occurrence, source-system recording, collection, and SIEM ingestion. Clock drift, daylight-saving changes, queue delays, and time-zone conversions can reorder events. Correlation should therefore use time windows rather than assuming exact timestamp equality.

Recognizing Malicious Behaviour

Malicious processes and persistence

Suspicion increases when a process has an unusual location, lacks a valid signature, uses a misleading name, starts from an office document or script interpreter, launches with encoded arguments, or communicates externally without a business explanation. The strongest assessment combines process ancestry, memory characteristics, user context, file history, and network behaviour.

Persistence may appear through scheduled tasks, services, startup folders, login scripts, registry run keys, management instrumentation, cloud tokens, or modified authentication components. Memory may show the currently active payload even when the persistence mechanism has been removed. Conversely, a suspicious persistence entry without execution evidence may represent an abandoned or failed attempt.

Lateral movement

Lateral movement is the use of one system or identity to reach another. Indicators include unusual remote logons, authentication failures followed by success, use of administrative protocols, service creation, remote task execution, remote desktop activity, administrative-share access, and rapid access to multiple hosts. Analysts should distinguish administrative activity from abuse by considering account role, time, source location, change tickets, command lines, and the relationship between the account and the target systems.

A common pattern is credential reuse: a workstation account authenticates to a file server, then a privileged account appears on several systems, followed by process creation through a remote service. No single record proves the entire sequence; correlation across authentication and endpoint telemetry does.

Command and control

C2 often produces recurring outbound connections, low-volume beacons, unusual destinations, encrypted sessions with atypical applications, or DNS requests with regular timing. Useful features include periodicity, destination rarity, interval variance, packet-size distribution, TLS certificate and handshake characteristics, user-agent values, and the initiating process.

Detection should avoid assuming that all C2 uses a fixed interval or an obviously malicious IP address. Jitter, compromised legitimate services, proxies, and common cloud platforms complicate analysis. Process-to-socket attribution and comparison with known organizational software are therefore essential.

Collection and exfiltration

Exfiltration analysis combines data-access events, staging activity, compression or encryption processes, archive creation, removable-media events, DNS or web transfers, and unusual outbound volume. Byte volume alone is insufficient: a small transfer of highly sensitive credentials may be more serious than a large transfer of public files. Investigators should identify the likely data owner, collection path, destination, protocol, encryption, and whether the transfer was authorized.

Anti-forensic behaviour

Adversaries may clear event logs, stop agents, alter timestamps, delete tools, remove scheduled tasks, use living-off-the-land utilities, disable packet capture, or route traffic through intermediate systems. Evidence of anti-forensics includes gaps in otherwise regular logging, service-stop events, mismatched local and centralized records, abrupt deletion, and commands associated with clearing or disabling controls.

Anti-forensic indicators must be distinguished from operational failure. A network outage, storage limit, agent upgrade, or routine log rotation can produce similar gaps. Comparison with independent sources—firewall records, cloud audit logs, memory, and network infrastructure—is crucial.

Applied Case: The Quiet Administrator

The following is an illustrative fictional case designed to show cross-source reasoning.

Background. Meridian Health Services operates a hybrid environment containing clinical applications, Windows servers, cloud identity services, and centralized endpoint telemetry. A security analyst notices that a finance workstation has generated periodic encrypted connections to a previously unseen domain.

Situation. The workstation’s user reports no unusual activity. The SIEM shows a successful privileged logon to two file servers at 02:14, followed by access to a directory containing patient billing exports. At 02:20, endpoint telemetry stops arriving from the workstation for 11 minutes.

Analysis. Flow records show small outbound connections every 61 to 64 seconds for three hours before the alert. DNS data shows repeated queries for subdomains with long, apparently encoded labels. Memory acquisition identifies a signed system process containing a private executable memory region and a thread whose start address is outside the normal image. The process has an outbound socket to the suspicious domain. Its parent is a script interpreter launched from a user-writable directory.

Authentication records show that the workstation’s ordinary user account authenticated to a file server, but the privileged logon used a service account normally restricted to backup servers. Endpoint records on the file server show archive creation and access to billing files. Firewall flow data indicates a 480-megabyte encrypted transfer from the workstation to an external hosting provider. The exact contents cannot be recovered from the available packet capture.

The analyst initially considers whether the activity could be a backup job. That hypothesis is weakened by the workstation source, the service account’s unusual location, the injected process, the regular beaconing, and the absence of a scheduled backup task. The temporary telemetry gap is consistent with an attempt to stop the endpoint agent, but an infrastructure maintenance record must be checked before treating it as deliberate tampering.

Approach and response. The response team isolates the workstation while preserving memory and relevant disk artefacts. They disable and rotate the service account, revoke active sessions, block the domain and associated indicators, and search for the same process and DNS pattern across the environment. They review cloud audit logs and file-server access records to identify the complete set of potentially exposed files. The organization also preserves firewall and provider records because payload inspection is unavailable.

Outcome. Correlation supports high confidence that the workstation was compromised, used to obtain or misuse a service credential, and used for lateral access and unauthorized collection. The precise exfiltrated file set remains uncertain because encryption prevented content inspection and some endpoint records were missing. The incident is therefore reported with a distinction between confirmed access, probable staging, and possible exfiltration.

Learning points. The case demonstrates that a suspicious domain alone is weak evidence, whereas memory-based process attribution, DNS periodicity, authentication anomalies, endpoint events, and flow volume reinforce one another. It also shows why uncertainty must be recorded rather than hidden. A defensible report can establish compromise and access without claiming more about exfiltrated content than the evidence supports.

Tools, Automation, and Analytical Practice

Memory frameworks can enumerate processes, modules, handles, sockets, injected regions, and credential-related artefacts. Packet-analysis tools support protocol dissection, stream reconstruction, filtering, and statistical examination. Flow and DNS platforms provide aggregation and long-term trend analysis. Endpoint and SIEM systems support searches, detection rules, timelines, and cross-host correlation.

Automation is valuable for repetitive tasks such as extracting indicators, calculating beacon intervals, enriching domains, clustering similar command lines, and generating timelines. Machine-learning methods can identify unusual users, destinations, process trees, or transfer volumes, but anomaly is not equivalent to maliciousness. Models inherit collection bias, may be evaded, and can be difficult to explain. High-impact conclusions should remain reviewable by an analyst and supported by source evidence.

A mature analytical process uses detection engineering: define the behaviour, identify required data fields, test against benign activity, measure false positives and false negatives, and document exceptions. Rules should be version-controlled and periodically reviewed as infrastructure changes.

Limitations, Governance, and Professional Responsibility

The principal limitations are incompleteness, encryption, weak attribution, clock inconsistency, retention limits, shared infrastructure, and evidence alteration during collection. Memory may contain sensitive personal data, credentials, health information, or unrelated user content. Packet captures can expose communications of individuals who are not subjects of the investigation. Collection must therefore be authorized, scoped, minimized, protected, and retained according to applicable law and organizational policy.

Investigators should maintain chain of custody, role-based access, integrity hashes, audit trails, and reproducible procedures. They should avoid unnecessary browsing of personal content, document privileged or legally restricted material, and separate investigative facts from speculation. Incident response may justify rapid containment, but urgency does not eliminate the need for evidence preservation or proportionality.

Organizations should design logging for investigation rather than merely compliance. Important controls include synchronized clocks, centralized and tamper-resistant storage, sufficient retention, consistent identity fields, endpoint process telemetry, DNS visibility, network-flow collection, alert-quality measurement, and tested restoration of logs. Privacy impact assessments and data-governance controls should accompany expanded monitoring.

Current Developments and Best Practices

Modern environments increasingly distribute evidence across cloud identity systems, software-as-a-service platforms, containers, mobile endpoints, encrypted protocols, and identity-centric access controls. Cloud audit events may be more informative than traditional network boundaries, while container and orchestration logs introduce short-lived workloads and dynamic addresses. Encrypted traffic analysis is shifting toward metadata, endpoint attribution, and controlled decryption where legally and technically appropriate.

Best practice is to:

• collect volatile evidence before shutdown when feasible;
• preserve raw records and document every transformation;
• use multiple independent sources for important conclusions;
• maintain accurate time synchronization and record clock quality;
• attribute network activity to processes and users where possible;
• compare anomalies with a documented organizational baseline;
• distinguish confirmed facts, supported inferences, and unresolved possibilities;
• protect investigative data with least privilege and strong retention controls; and
• test detection and response procedures through exercises.

Chapter Summary

Memory, network, and log forensics provide complementary views of an incident. Memory reveals execution and volatile state; packets and flows reveal communication; DNS connects hosts and domains; authentication records expose identity use and lateral movement; endpoint telemetry links processes to files and sockets; and centralized logs provide searchable historical context. Reliable investigation depends on preservation, normalization, baselining, correlation, hypothesis testing, and transparent reporting.

Malicious processes, C2, lateral movement, collection, exfiltration, and anti-forensic activity are best identified through converging evidence rather than isolated indicators. Encryption, missing logs, shared infrastructure, clock drift, and privacy concerns limit certainty. Professional investigators must therefore combine technical skill with disciplined reasoning, governance, legal awareness, and explicit treatment of uncertainty.

Key Terms

Memory forensics: Examination of volatile system memory to identify processes, code, connections, and other transient artefacts.

Volatile evidence: Evidence that may disappear or change when a system is powered off or continues operating.

Process injection: Placement or execution of code within another process’s memory space.

Process ancestry: The parent-child relationship among processes, used to assess how execution began.

Packet capture: A record of network packets, including headers and sometimes payloads.

Flow record: A summary of communication metadata such as addresses, ports, times, and byte counts.

DNS telemetry: Records describing domain queries, responses, resolvers, and associated timing.

Endpoint telemetry: Host-level records of processes, files, scripts, registry changes, and connections.

SIEM: A platform that aggregates, normalizes, correlates, and analyses security events.

Lateral movement: Adversary activity that uses systems or identities to access additional systems.

Command and control: Communication through which an attacker manages compromised systems.

Beaconing: Repeated, often periodic communication between a host and a remote service.

Exfiltration: Unauthorized transfer of data from an environment.

Anti-forensics: Actions intended to hide, alter, destroy, or complicate digital evidence.

Timeline normalization: Conversion and interpretation of event times using a documented reference standard.

Baseline: A representation of expected normal activity used to identify anomalies.

Evidence correlation: Linking observations from different sources using shared attributes and context.

Chain of custody: Documented control and handling history of evidence.

Review Questions

Short Answer Questions

1. Why is volatile memory often more informative about execution than a disk image?

2. What is the difference between a packet capture and a flow record?

3. Identify three indicators that may suggest process injection.

4. Why does a missing log record not prove that an event did not occur?

5. What is the purpose of timeline normalization?

Long Answer Questions

1. Explain a structured workflow for correlating memory, network, DNS, authentication, endpoint, and centralized-log evidence.

2. Discuss how investigators can distinguish legitimate administration from lateral movement.

3. Explain the evidentiary value and limitations of DNS telemetry in detecting command-and-control activity.

4. Analyse the role of baselines, process-to-socket attribution, and hypothesis testing in incident investigation.

5. Discuss the ethical, legal, and governance issues involved in collecting memory and packet data.

Analytical / Application Questions

1. A workstation makes periodic encrypted connections to a rare domain, while a privileged account accesses several servers at night. What additional evidence would you seek, and how would you assess competing explanations?

2. A SIEM shows an 18-minute gap in endpoint telemetry, but firewall flows continue. Develop an investigative approach to determine whether the gap reflects agent failure, network disruption, or anti-forensic activity.

3. A large outbound transfer is observed from a database server to a common cloud provider. Explain how you would determine whether it represents authorized backup activity or exfiltration.

22. Multiple Choice Questions with Answers

Question 1

Which combination provides the strongest support for process injection?

A. A signed process with normal memory regions and no network activity

B. Executable memory not backed by an image, an unusual thread start address, and a suspicious parent process

C. A recently updated operating-system process with a valid signature

D. A process that has been running for several days without errors

Correct Answer: B. Executable memory not backed by an image, an unusual thread start address, and a suspicious parent process

Question 2

What is the principal advantage of flow records over full packet captures?

A. They always reveal the transferred file contents

B. They provide complete command-line information

C. They summarize communications efficiently for large-scale and long-term analysis

D. They eliminate the need for endpoint telemetry

Correct Answer: C. They summarize communications efficiently for large-scale and long-term analysis

Question 3

Which observation most directly links a suspicious network connection to a host process?

A. A domain has a poor reputation score

B. A flow record shows high byte volume

C. Endpoint telemetry attributes the socket to a script-launched process with injected memory

D. The connection uses TCP rather than UDP

Correct Answer: C. Endpoint telemetry attributes the socket to a script-launched process with injected memory

Question 4

Why should event occurrence time be distinguished from SIEM ingestion time?

A. Ingestion time is always more accurate

B. Events may be delayed or queued before reaching the SIEM

C. Occurrence time is never recorded by endpoints

D. The distinction is relevant only to packet captures

Correct Answer: B. Events may be delayed or queued before reaching the SIEM

Question 5

Which pattern is most suggestive of possible DNS tunnelling?

A. One query for a common internal service

B. Frequent long, encoded-looking labels with unusual record types and high query volume

C. A successful reverse lookup of a mail server

D. A DNS response with a normal time-to-live

Correct Answer: B. Frequent long, encoded-looking labels with unusual record types and high query volume

Question 6

Which evidence combination best supports lateral movement?

A. A failed local login followed by a screen lock

B. An unusual successful remote logon, remote service execution, and process creation on the target host

C. A browser contacting a popular search engine

D. A scheduled backup running under its documented service account

Correct Answer: B. An unusual successful remote logon, remote service execution, and process creation on the target host

Question 7

How should an investigator interpret a suspicious domain found in threat intelligence?

A. As conclusive proof that the host is compromised

B. As irrelevant unless payload content is available

C. As a lead requiring corroboration with local and network evidence

D. As proof that all users of the domain are malicious

Correct Answer: C. As a lead requiring corroboration with local and network evidence

Question 8

Which statement best describes a sound forensic hypothesis?

A. It accepts the first plausible explanation

B. It states a proposition, identifies expected evidence, and seeks both confirming and disconfirming observations

C. It relies only on analyst intuition

D. It excludes evidence that conflicts with the initial alert

Correct Answer: B. It states a proposition, identifies expected evidence, and seeks both confirming and disconfirming observations

Question 9

A gap in centralized logs is discovered during an incident. What is the most appropriate next step?

A. Assume no activity occurred during the gap

B. Delete the incomplete records

C. Compare independent sources such as endpoint, firewall, memory, and infrastructure records

D. Treat every event before and after the gap as malicious

Correct Answer: C. Compare independent sources such as endpoint, firewall, memory, and infrastructure records

Question 10

Why is a large outbound transfer not, by itself, proof of exfiltration?

A. Exfiltration never involves large files

B. Legitimate backups and synchronization may produce similar volumes

C. Flow records cannot record byte counts

D. Encrypted traffic cannot be measured

Correct Answer: B. Legitimate backups and synchronization may produce similar volumes