Presentations

Timeline Forensics with TimeSketch

October 21, 2026 · Presented by Colin Yeager

timelinetimesketchwindows

What we covered

• Why volatile memory holds evidence that never touches disk
• Acquiring memory safely on a live system
• Core Volatility 3 plugins: windows.pslist, windows.netscan, windows.cmdline, windows.malfind

Lab commands

vol -f memdump.raw windows.info
vol -f memdump.raw windows.pslist
vol -f memdump.raw windows.netscan

Further reading

• Volatility 3 documentation