Volatility

Volatility 2

GitHub - volatilityfoundation/volatility: An advanced memory forensics frameworkGitHub

Vol2 Requires profiles, i.e. Win10x64_16299, the following command can held identify the build strings, but may not be able to based on the local symbol table available:

vol.py -f [image] kdbgscan

vol.py -f [image] --profile=[profile] [plugin]

# Extract objects
vol.py -f [image] --profile=[profile] dlldump
vol.py -f [image] --profile=[profile] moddump
vol.py -f [image] --profile=[profile] procdump
vol.py -f [image] --profile=[profile] memdump
vol.py -f [image] --profile=[profile] filescan
vol.py -f [image] --profile=[profile] dumpfiles
vol.py -f [image] --profile=[profile] mftparser
vol.py -f [image] --profile=[profile] shimcachemem
vol.py -f [image] --profile=[profile] cmdscan
vol.py -f [image] --profile=[profile] svcscan

# Additional plugins
psxview

Volatility 3

Memory Extraction:

vol2	vol3
dlldump	windows.dlllist	dump DLLs
moddump	windows.modules	Extract Kernel Drivers
procdump	windows.pslist	Dump executable process - most similar to original executeablewinmemdecompress.py
memdump	windows.memmap	dump all addressable process memory (contains both code and data - good for running strings against) also preferred over memprocfs
filescan	windows.filescan	Scan memory for FILE_OBJECTS
dumpfiles	windows.dumpfiles	Extract cached files via FILE_OBJECTS
mftparser	windows.mftscan	Extract and parse NTFS Master File Table
shimcachemem	N/A	Extract Application compat cache
cmdscan	N/A	Scan for COMMAND_HISTORY buffers
svcscan	windows.svcscan	Carve service info from in-memory registry