How to extract a .bat file with volatility

Question

I am experimenting with the volatility2 tool. I have created a memorydump of a windows 7 machine where i had a batch script file on the desktop of the machine. I used the mftparser command as :

volatility -f memdump.mem --profile=Win7SP1x64 mftparser | grep -i "desktop"

which resulted in :

-snip-

2023-02-22 01:38:18 UTC+0000 2023-02-22 01:38:18 UTC+0000   2023-02-22 01:38:18 UTC+0000   2023-02-22 01:38:18 UTC+0000   RemoteDesktops
2023-02-22 01:38:18 UTC+0000 2023-02-22 01:38:18 UTC+0000   2023-02-22 01:38:18 UTC+0000   2023-02-22 01:38:18 UTC+0000   Users\Public\Desktop
2023-02-22 01:43:42 UTC+0000 2023-02-22 01:43:42 UTC+0000   2023-02-22 01:43:42 UTC+0000   2023-02-22 01:43:42 UTC+0000   Users\[username]\Desktop
2023-02-22 02:28:40 UTC+0000 2023-02-22 02:28:40 UTC+0000   2023-02-22 02:28:40 UTC+0000   2023-02-22 02:28:40 UTC+0000   Users\[username]\Desktop\memdump.mem
2023-02-21 15:59:20 UTC+0000 2023-02-21 15:59:20 UTC+0000   2023-02-21 15:59:20 UTC+0000   2023-02-21 15:59:20 UTC+0000   Users\[username]\Desktop\WINDOW~1\WINDOW~1.BAT
2023-02-21 15:59:20 UTC+0000 2023-02-21 15:59:20 UTC+0000   2023-02-21 15:59:20 UTC+0000   2023-02-21 15:59:20 UTC+0000   Users\[username]\Desktop\WINDOW~1\Windows11Pro.bat
2023-02-22 01:38:28 UTC+0000 2023-02-22 01:38:28 UTC+0000   2023-02-22 01:38:28 UTC+0000   2023-02-22 01:38:28 UTC+0000   Windows\assembly\Desktop.ini

-snip-

So i want to dump the Users[username]\Desktop\WINDOW~1\Windows11Pro.bat file. I used the filescan command as :

volatility -f memdump.mem --profile=Win7SP1x64 filescan | grep "Users\[username]\Desktop\WINDOW~1\Windows11Pro.bat"

but i get no results back. Why is that? I tried other grep alternatives but it seems i cant locate the address of this batch file.

Answer 1

The dump of the main memory (RAM) would only contain details about files that are in RAM, like those that are currently running.

An NTFS system uses MFT to manage secondary storage, which is likely used all the time and hence exists in the main memory. This explains why you could see the path of the .bat file (as it was data held by MFT).

A running program is more likely visible in a memory dump.