## Why Memory Forensics?

Disk Forensics is great, but it has limits.
*   **Encryption**: If the disk is BitLocker encrypted and the computer is off, the data is gone.
*   **Fileless Malware**: Some malware lives *only* in RAM. It never touches the hard drive. If you pull the plug, the evidence vanishes.
*   **Rootkits**: Kernel-level rootkits can lie to the OS, but they cannot hide from memory analysis (mostly).

### What lives in RAM?
Everything the computer is thinking about *right now*.
1.  **Running Processes** (and their injected DLLs).
2.  **Network Connections** (Active sockets).
3.  **Command History** (cmd.exe / powershell.exe buffers).
4.  **Passwords/Keys**:
    *   BitLocker keys.
    *   Mimikatz output.
    *   User passwords (sometimes in cleartext if poorly coded apps are running).
5.  **Clipboard Contents**: What did the user just Copy/Paste?

### The Principle of Exchange
RAM is extremely volatile. Every second the computer is on, thousands of pages of memory are being overwritten. Speed is essential.