Memory Forensics for Your Business
Memory forensics services capture and examine what a computer holds in RAM, which is often where the real story of an attack sits. Omeiro takes live memory dumps and analyses them with Volatility to find injected DLLs, active network sockets, unencrypted keys and fileless malware that never touches the disk.
What memory forensics looks at
The main areas we check, by hand with tools as support. The exact scope depends on your package and is agreed in writing before work starts.
Alerts and logs
- Which logs are kept
- Alert rules
- Who gets alerted
What happened
- Timeline of events
- Affected systems
- Entry point
Clean-up
- Removing access
- Resetting secrets
- Restoring from backup
Next time
- Written response steps
- Contacts list
- Lessons learned
Checklist Based on common risks and good practice. The exact scope depends on your package and is agreed in writing before work starts.
What you get with memory forensics
Forensic live memory dumps (Volatility) capturing in-memory injected DLLs, unencrypted encryption keys, active network sockets, and fileless malware executing exclusively in RAM.
Basic Package
Memory capture; analysis of 1 machine. 2-day delivery, 2 revisions.
Standard Package
Up to 4 machines. 4-day delivery, 2 revisions.
Premium Package
Up to 10 machines; report. 6-day delivery, 2 revisions.
Clear brief first
We confirm what you need before work starts, so the scope is clear on both sides.
Revisions listed
Each package shows its revision rounds. A round is one list of changes sent together.
Yours once paid
Copyright of the final work passes to you once the order is paid in full.
Work starts only after the scope is agreed in writing and you confirm you own or control the systems involved.
How our memory forensics works
Capture
Memory is acquired from the running machine with tools that disturb it as little as possible.
Preserve
The image is hashed and stored so it can be checked later.
Analyse
Volatility plugins reveal processes, injected code, connections and keys.
Explain
Findings are summarised in plain language with the artefacts behind them.
Memory forensics: preparing before you capture RAM
Memory forensics is time-sensitive because RAM contents vanish when power is lost, so preparation helps. Tell us the operating system, whether the machine is physical or virtual and how it is accessed. For virtual machines, a snapshot that includes memory can serve as the capture. Memory holds things disks do not: running processes, injected code, network connections, loaded drivers and sometimes keys or passwords in clear text.
Analysis with Volatility compares what the system reports with what is truly in memory, which exposes hidden processes and injected modules. Good memory forensics output lists suspicious processes, their relationships, network connections and extracted artefacts, along with a confidence level for each finding. It pairs with malware analysis when a payload is recovered, and with a compromise assessment when you need to know how far the intruder reached.
In short
- Delivery in 2 to 6 days, by package.
- Fixed price, shown before you order.
- Responders who suspect malware that leaves no files behind.
- Copyright yours after full payment.
Memory Forensics: common questions
How much does memory forensics cost?
Prices are fixed and shown by package on our Memory Forensics pricing page, so you see the full price before you order. You can also ask for a custom quote.
How long does volatile memory acquisition take?
Delivery depends on the package: Basic 2-day delivery; Standard 4-day delivery; Premium 6-day delivery.
What is included in the Basic Package?
The Basic Package includes: Memory capture; analysis of 1 machine. Higher packages add more scope, revisions and support.
Can I get a custom live memory forensic analysis package?
Yes. If none of the packages fits, use the custom package form on our pricing page to describe what you need, and our team sends you a fixed price.
Should I turn the machine off first?
No. Powering off destroys memory evidence, so leave it running and contact us.
Can you find fileless malware?
Memory analysis is one of the best ways to spot it, since it lives in RAM.
Will capture affect the machine?
It causes minor load, and we explain what to expect beforehand.
Can you analyse a dump we already took?
Yes, send the image and tell us the operating system.
What can memory forensics find that disk forensics cannot?
Disk analysis shows what was saved, while memory shows what was running. That includes injected code, decrypted data, live connections and malware that never wrote a file.
Who owns the final work?
Copyright of the final work passes to you once the order is paid in full. Paid fonts, stock files or licences, if used, are licensed in your name.
Ready to start your memory forensics?
Compare the packages and pick the one that fits. Not sure which? Write to us and we will help you choose.