The adoption of memory forensics - the art of extracting artifacts from the volatile memory of a compromised system - is spreading in cyber-security investigations. The main reason of this enthusiasm comes from the fact that many artifacts can not be found elsewhere. In this way, the forensics analysts can gain the big picture over a malicious behavior. Nevertheless, memory forensics is less than two decades old: many challenges are unsolved and many questions are unanswered. This thesis gives a new perspective over three of these problems. The first contribution studies the effects non-atomic acquisition methods. The root cause of this problem is quite straightforward to explain: while the memory is acquired, user and kernel processes are running and therefore modifying the content of the memory. For this reason, the resulting memory dump does not represent the state of the memory in a given point in time, but rather a mix of multiple points. The second contribution focus on automatically extracting a forensics profile from a memory dump. Having a valid profile is a strong requirement for memory analysis because without one any structured memory forensics technique can be applied. Therefore, this problem effectively prevents memory forensics to be applied in those scenarios where creating a profile is harder -- if not impossible. The third and last contribution of this thesis aims to change how forensics rules, better known as plugins, are created. Nowadays, these rules are manually written by kernel experts and forensics practitioners. Unfortunately, this manual approach does not have any guarantee on the quality or on the uniqueness of these rules.