Volatility
Last updated
Last updated
Vol2 Requires profiles, i.e. Win10x64_16299, the following command can held identify the build strings, but may not be able to based on the local symbol table available:
dlldump
windows.dlllist
dump DLLs
moddump
windows.modules
Extract Kernel Drivers
procdump
windows.pslist
Dump executable process - most similar to original executeablewinmemdecompress.py
memdump
windows.memmap
dump all addressable process memory (contains both code and data - good for running strings against) also preferred over memprocfs
filescan
windows.filescan
Scan memory for FILE_OBJECTS
dumpfiles
windows.dumpfiles
Extract cached files via FILE_OBJECTS
mftparser
windows.mftscan
Extract and parse NTFS Master File Table
shimcachemem
N/A
Extract Application compat cache
cmdscan
N/A
Scan for COMMAND_HISTORY buffers
svcscan
windows.svcscan
Carve service info from in-memory registry
