2

I am experimenting with the volatility2 tool. I have created a memorydump of a windows 7 machine where i had a batch script file on the desktop of the machine. I used the mftparser command as :

volatility -f memdump.mem --profile=Win7SP1x64 mftparser | grep -i "desktop"

which resulted in :

-snip-

2023-02-22 01:38:18 UTC+0000 2023-02-22 01:38:18 UTC+0000   2023-02-22 01:38:18 UTC+0000   2023-02-22 01:38:18 UTC+0000   RemoteDesktops
2023-02-22 01:38:18 UTC+0000 2023-02-22 01:38:18 UTC+0000   2023-02-22 01:38:18 UTC+0000   2023-02-22 01:38:18 UTC+0000   Users\Public\Desktop
2023-02-22 01:43:42 UTC+0000 2023-02-22 01:43:42 UTC+0000   2023-02-22 01:43:42 UTC+0000   2023-02-22 01:43:42 UTC+0000   Users\[username]\Desktop
2023-02-22 02:28:40 UTC+0000 2023-02-22 02:28:40 UTC+0000   2023-02-22 02:28:40 UTC+0000   2023-02-22 02:28:40 UTC+0000   Users\[username]\Desktop\memdump.mem
2023-02-21 15:59:20 UTC+0000 2023-02-21 15:59:20 UTC+0000   2023-02-21 15:59:20 UTC+0000   2023-02-21 15:59:20 UTC+0000   Users\[username]\Desktop\WINDOW~1\WINDOW~1.BAT
2023-02-21 15:59:20 UTC+0000 2023-02-21 15:59:20 UTC+0000   2023-02-21 15:59:20 UTC+0000   2023-02-21 15:59:20 UTC+0000   Users\[username]\Desktop\WINDOW~1\Windows11Pro.bat
2023-02-22 01:38:28 UTC+0000 2023-02-22 01:38:28 UTC+0000   2023-02-22 01:38:28 UTC+0000   2023-02-22 01:38:28 UTC+0000   Windows\assembly\Desktop.ini

-snip-

So i want to dump the Users[username]\Desktop\WINDOW~1\Windows11Pro.bat file. I used the filescan command as :

volatility -f memdump.mem --profile=Win7SP1x64 filescan | grep "Users\[username]\Desktop\WINDOW~1\Windows11Pro.bat"

but i get no results back. Why is that? I tried other grep alternatives but it seems i cant locate the address of this batch file.

2 Answers 2

1

The dump of the main memory (RAM) would only contain details about files that are in RAM, like those that are currently running.

An NTFS system uses MFT to manage secondary storage, which is likely used all the time and hence exists in the main memory. This explains why you could see the path of the .bat file (as it was data held by MFT).

A running program is more likely visible in a memory dump.

0

You may have luck in altering the way in which you perform your filter looking for the specific file. The pathing may simply not match the full directory you're utilizing within grep, so start by trying to broaden that search. It could also be that a version of the file (such as the version being edited) was available in memory with a slightly different name (e.g. if the file utilized the truncated DOS naming WINDOW~1.BAT).

If you get no results then you may not have the ability to pull the file with dumpfiles (the next step) because it wasn't loaded into memory at the time you took the image.

volatility -f memdump.mem --profile=Win7SP1x64 filescan | grep -iE 'bat|window|pro'

Should that produce a file or files, you can then use the filedump plugin (-Q for the physical memory offset and -D for the directory to dump to):

volatility -f memdump.mem --profile=Win7SP1x64 dumpfiles -Q 0x012345678 -D outfiles/

The Command Reference for mftparser does state that the mftparser plugin gives the ability to dump resident files (those files in which the entire entry is contained within the MFT entry and not fragmented across multiple MFT records). So you may have luck in an attempt to dump those resident files with mftparser and cat through everything to see if even fragments of that file were loaded into memory.

volatility -f memdump.mem --profile=Win7SP1x64 mftparser -D mftparser-output
cat mftparser-output/*

Reference for related concepts: OMFW 2012: Reconstructing the MBR and MFT from Memory .

Additionally you may look at Volatility3. With the Symbol Tables for the different OSes and primary development going into plugins for v3 as of late, you could potentially see different (hopefully improved) results. I lack the anecdotal evidence from my experience for version 3, but worth a shot I say!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .