Lab 15.4 - Practice Memory Image
==================================

A real Windows memory dump (mem.raw) is not distributed with this lab
pack because such images contain credentials, keys, and personal data.

To obtain a legitimate practice image, use one of the following:

  1. Volatility Foundation sample images:
     https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples
     The project wiki links to public memory samples used in documentation
     and competitions; several are Windows 7/10 images with known malware
     artefacts suitable for pslist/malfind exercises.

  2. CyberDefenders "HawkEye" and similar forensic challenges:
     https://cyberdefenders.org/blueteam-ctf-challenges/hawkeye
     Provide memory images with documented IOCs (injected processes,
     network connections) matching exactly the lab steps in section 15.4.

  3. Your own Windows VM:
     Use WinPmem (https://github.com/Velocidex/WinPmem) or
     Magnet RAM Capture (https://www.magnetforensics.com/) to dump
     the memory of your own test VM.
     Rename the output to mem.raw and place it here.

  4. The companion notebook 15a_volatility_walkthrough.ipynb walks the
     pslist -> pstree -> malfind -> ransomware-indicator sequence
     against a guided synthetic dataset if no real image is available.

Integrity note: record the SHA-256 of your image before analysis:
    sha256sum mem.raw
This is your acquisition hash. Re-hash after analysis and confirm they match.
