#rootkit detection

Memory Forensics with Volatility — RAM Analysis for Incident Response That Works

Someone ran ransomware. System logs say little, Windows events are gone. The disk is encrypted, but RAM still holds ever...