Volatility

LogoGitHub - volatilityfoundation/volatility: An advanced memory forensics frameworkGitHub

Vol2 Requires profiles, i.e. Win10x64_16299, the following command can held identify the build strings, but may not be able to based on the local symbol table available: 

vol.py -f [image] kdbgscan
vol.py -f [image] --profile=[profile] [plugin]

# Extract objects
vol.py -f [image] --profile=[profile] dlldump
vol.py -f [image] --profile=[profile] moddump
vol.py -f [image] --profile=[profile] procdump
vol.py -f [image] --profile=[profile] memdump
vol.py -f [image] --profile=[profile] filescan
vol.py -f [image] --profile=[profile] dumpfiles
vol.py -f [image] --profile=[profile] mftparser
vol.py -f [image] --profile=[profile] shimcachemem
vol.py -f [image] --profile=[profile] cmdscan
vol.py -f [image] --profile=[profile] svcscan

# Additional plugins
psxview

Memory Extraction:

vol2
vol3

dlldump

windows.dlllist

dump DLLs

moddump

windows.modules

Extract Kernel Drivers

procdump

windows.pslist

Dump executable process - most similar to original executeablewinmemdecompress.py

memdump

windows.memmap

dump all addressable process memory (contains both code and data - good for running strings against) also preferred over memprocfs

filescan

windows.filescan

Scan memory for FILE_OBJECTS

dumpfiles

windows.dumpfiles

Extract cached files via FILE_OBJECTS

mftparser

windows.mftscan

Extract and parse NTFS Master File Table

shimcachemem

N/A

Extract Application compat cache

cmdscan

N/A

Scan for COMMAND_HISTORY buffers

svcscan

windows.svcscan

Carve service info from in-memory registry

PreviousStrings, bstrings and grepNextVolWeb

Last updated