Add volatility: memory forensics framework