Today I learned about Volatility. I've never really looked into forensics before; it's interesting that there's an entirely separate set of tools for determining the state a system was in when the memory was dumped, defined by analogy with tools like pstree that you'd ordinarily use to examine a running system. Seems like a bit of cat-and-mouse though; as an attacker with a code running in the kernel, you'd want to politely excuse yourself from memory images. Admittedly I don't understand malware very well; there may be techincal reasons why this is not possible.