Problem Statement
Explain what memory forensics is and how it is useful in system security investigations.
Explanation
Memory forensics is the process of capturing and analysing the volatile memory (RAM) of a system to uncover live processes, network connections, loaded modules, encryption keys or other artefacts that may not persist on disk. It is especially useful in detecting stealthy threats like rootkits or file-less malware which leave no footprints on disk. This technique gives deeper visibility into attacker behaviour and is increasingly referenced in system security operations.
