<p>Memory forensics is a collection of techniques using a machine’s memory footprint to locate traces of processes, files, and network connections. This has proven beneficial for identifying malicious factors in the aftermath of an attack. However, these techniques are mainly based on the analysis of physical memory. In this work, we experiment with virtual memory and discover how memory forensics can be performed directly in virtual memory. We substantiate our findings by deploying advanced techniques such as pool tag quick scanning and PTE/PFN database analysis, both of which represent the state of the art in memory forensics for enumerating kernel objects and detecting code injection in processes. Our work is a prototype for many use cases, such as live kernel inspection (similar to WinDBG), providing metadata for memory extraction images, an anti-cheat engine using memory forensics for detection, and Endpoint Detection and Response with memory forensics.</p>