Memory analysis can help fill gaps in your coverage if you don't have Sysmon or an expensive EDR solution and want to get process execution trees, open file handles, mutexes, executed command lines, browsed folders and much, much more. In this talk I will give some background on the tool, it's fork Rekall and where they both fit in. Then we will discuss memory acquisition, supported formats and how to select the correct OS build profiles. Basic plugin usage will be conveyed for displaying useful information and to dump out intact files/process executables for performing further analysis. Then I will demonstrate techniques that I use for responding to alerts and identifying malware and behavior from indicators. Finally I will give examples on how to write Yara rules and to script out Volatility commands to further enrich the data and then visualize it for easier analyst consumption.