I tested what Windows RAM actually preserves after normal user activity
Source Reddit ExploitDev
Discussion
This report details a controlled memory forensics investigation on a Windows 11 system to determine what user activity can be reconstructed from a RAM capture. The experiment involved normal user actions such as browsing with Edge, running PowerShell commands, and typing unsaved text in Notepad. Memory was acquired using WinPmem and analyzed with Volatility 3, revealing recoverable artifacts including running processes, command-line arguments, network state, and unsaved text. The findings emphasize that memory forensics is most effective when multiple artifacts are correlated rather than analyzed in isolation. This is a research and educational exercise rather than a vulnerability or exploit.
r/ExploitDev (opens in a new tab)u/chronosAndCode0 points0 comments
I wanted to see how much normal Windows activity could actually be reconstructed from a RAM capture, so I built a small controlled Windows 11 lab.
Before acquisition I intentionally:
opened Edge and browsed to a website
launched PowerShell
ran whoami, ipconfig, and Get-Process
opened Notepad
typed unsaved text and left it open
I captured memory with WinPmem, hashed the image with SHA-256, and analyzed it in Kali with Volatility 3.
The most useful findings were:
msedge.exe, powershell.exe, Notepad.exe, and explorer.exe recovered from memory
parent/child relationships showing PowerShell and Notepad launched from explorer.exe
command-line paths for the processes
execution-related strings for whoami.exe and ipconfig.exe
references to Get-Process
network state associated with Edge using windows.netstat
the exact unsaved Notepad text recovered directly from RAM
One thing I found interesting was that windows.netscan returned nothing useful, while windows.netstat did recover network state. It was a good reminder not to rely on one plugin as the only source of truth.
The biggest takeaway for me was that the investigation became useful only when the artifacts were correlated rather than treated separately.
I wrote up the full lab with screenshots and commands here:
https://chronosandcode.com/memory-forensics-investigation-volatility/
Disclosure: this is my own write-up on Chronos & Code. All activity was generated inside a lab I controlled.
I’d be curious what other Volatility plugins people here would have used on the same image.