Memory-forensics Timeline Correlation Laboratory
An offline Python laboratory that combines selected Volatility 3 process, memory, network, and registry exports into one explainable incident timeline.

Project definition
Problem statement
A memory investigation can produce separate process, scan, network, executable-memory, and registry records. Reading each source alone can hide the relationship between events.
This project normalises selected Volatility 3 JSONL exports, links related records by process and time, and retains the source evidence behind each finding.
Project objectives
- Import selected pslist, psscan, netscan, malfind, and printkey JSONL records.
- Normalise source fields into a consistent event schema without changing the original files.
- Build a time-ordered case timeline with process and evidence links.
- Apply six explainable rules for hidden processes, executable private memory, network activity, orphaned owners, autorun links, and suspicious parent-child relationships.
- Measure finding accuracy, evidence recovery, timeline order, and the effect of incomplete or noisy acquisition.
- Reproduce the complete controlled experiment from the command line.
Project structure
Project components
Volatility adapters
Convert five selected plugin exports into a common event structure.
Timeline builder
Orders normalised records and preserves process, timestamp, plugin, and source-file evidence.
Correlation engine
Links related records within a configurable time window and applies six explicit rules.
Case generator
Creates 12 safe synthetic plugin-style case bundles with independent truth labels.
Benchmark runner
Tests complete, noisy, partial, and time-skewed inputs across three correlation windows.
Evidence outputs
Writes JSON results, CSV trials, seven labelled figures, and an offline dashboard.
Methodology
Project workflow
- 01Prepare exports
Use an included case or export the selected Volatility 3 plugin results as JSONL.
- 02Import events
The adapters validate and normalise process, memory, network, and registry records.
- 03Correlate evidence
Events are linked by process identity, relationship, and the selected time window.
- 04Review findings
Each finding shows its rule, severity, explanation, event order, and supporting sources.
- 05Reproduce results
The benchmark command rebuilds all 144 trials, metrics, figures, and dashboard.
Demonstration scenario
A prepared case contains a process omitted from pslist but present in psscan, an executable private-memory region, a network connection, and an autorun registry record. The analyser joins the sources into one ordered explanation and retains every supporting record.
Engineering
Tools and method
- Core package
- Typed Python modules for schemas, input adapters, correlation, metrics, scenarios, experiments, and commands.
- Evidence model
- A small event schema retains source plugin, time, process identifiers, attributes, and traceable record references.
- Controlled experiment
- Twelve deterministic cases are evaluated under four acquisition conditions and three time windows.
- Quality controls
- 32 tests, 98.22 percent combined coverage, Ruff checks, dependency audit, repository validation, and document accessibility audits.
Testing
Evaluation
Evaluation measures
- Finding precision, recall, and F1 for each acquisition condition
- Recovery of the expected supporting evidence
- Timeline-order accuracy under source clock skew
- Comparison of 60, 180, and 300 second correlation windows
- Complete-capture and incident-case performance
- Automated tests, combined statement and branch coverage, and retained trial evidence
Project boundaries
- The included cases are controlled synthetic Volatility-style exports. They are not real memory images.
- Raw memory acquisition and direct memory-image parsing are outside this project.
- A correlation finding is not a malware verdict, attribution, or legal conclusion.
- Real evidence requires authorised acquisition, integrity controls, tool validation, and qualified review.
- No information is collected.
Included
- 01Complete Python source code and command-line tools
- 02Five selected Volatility 3 JSONL adapters
- 0312 controlled case bundles and 144 retained benchmark trials
- 04Seven result figures and a self-contained results dashboard
- 0532 automated tests with 98.22 percent combined statement and branch coverage
- 0697-page project report in PDF and editable Word formats
- 0721-page setup and usage guide in PDF and editable Word formats
- 0845 annotated references
Project record
No information is collected on this page.
- Permanent project ID
- GP-CY-12TEBKK
- Catalogued
- 21 Aug 2026
- Completed
- 24 Aug 2026
- Verified
- 24 Aug 2026
- Demonstration
- Included in repository
Handover
After purchase
- 01Payment is confirmed
The project is marked unavailable and cannot be purchased again.
- 02Repository access is granted
The buyer's submitted GitHub account receives access to the private repository.
- 03The purchase record is delivered
The certification sheet is prepared from the reviewed buyer details and sent privately by email.