Volatility

Overview

An advanced memory forensics framework

Resources

The Volatility Foundation - Promoting Accessible Memory Analysis Tools Within the Memory Forensics CommunityThe Volatility Foundation - Promoting Accessible Memory Analysis Tools Within the Memory Forensics Community

GitHub - volatilityfoundation/volatility: An advanced memory forensics frameworkGitHub

Install

Installation · volatilityfoundation/volatility WikiGitHub

Usage

Basic

Help

python vol.py -h

Windows

OS Information

image information

vol.py -f “file” windows.info

Process Information

Process List

vol.py -f “file” windows.pslist

vol.py -f “file” windows.psscan

vol.py -f “file” windows.pstree

Process Dump

vol.py -f “file” -o “/path/to/dir” windows.dumpfiles ‑‑pid <PID>

Memory Dump

vol.py -f “file” -o “/path/to/dir” windows.memmap ‑‑dump ‑‑pid <PID>

Handles

vol.py -f “file” windows.handles ‑‑pid <PID>

DLL

vol.py -f “file” windows.dlllist ‑‑pid <PID>

Command Line

vol.py -f “/path/to/file” windows.cmdline

Network Information

Network Scan

vol.py -f “file” windows.netscan

vol.py -f “file” windows.netstat

Registry

Hive List

vol.py -f “file” windows.registry.hivescan

vol.py -f “file” windows.registry.hivelist

Print Key

vol.py -f “file” windows.registry.printkey

vol.py -f “file” windows.registry.printkey ‑‑key “Software\Microsoft\Windows\CurrentVersion”

Files

Files Scan

vol.py -f “file” windows.filescan

Files Dump

vol.py -f “file” -o “/path/to/dir” windows.dumpfiles

vol.py -f “file” -o “/path/to/dir” windows.dumpfiles ‑‑virtaddr <offset>

vol.py -f “file” -o “/path/to/dir” windows.dumpfiles ‑‑physaddr <offset>

Miscellaneous

MalFind

vol.py -f “file” windows.malfind

Yara Scan

vol.py -f “file” windows.vadyarascan ‑‑yara-rules <string>

vol.py -f “file” windows.vadyarascan ‑‑yara-file “/path/to/file.yar”

vol.py -f “file” yarascan.yarascan ‑‑yara-file “/path/to/file.yar”

Linux

Mac OS