I'm trying to recover files from a .mem file with volatility. The mem file is from a Linux machine. I have already loaded the profile and it works fine. I have discovered that the drupalgeddon2 vulnerability was exploited but I need evidence.

To get that evidence I tried the volatility module linux_enumerate_files to enumerate all the files and look for the ones that could be malicious. I found some weird files in the /tmp folder and need to recover them, or at least the hash so that I can check in Virustotal if they are malicious.

To recover the files I tried the module linux_find_file like this:

python2 vol.py --profile=Linuxperfil_memoria_volatility2x64 -f /media/sf_drive-download-20230328T154924Z-001/memoria.bin linux_find_file -F "/tmp/kKUKJsTYJHOVIjKIXYg7wqlj0.php" -O ../Desktop/shell 

But the output is:

Inode Number                  Inode File Path
---------------- ------------------ ---------
----------------                0x0 /tmp/kKUKJsTYJHOVIjKIXYg7wqlj0.php

And the file shell is not created. I guess the reason volatility can't recover the file and store it in "shell" is because the file doesn't have an inode number, but I don't really know.

Is there any way I can recover this file with volatility?

PD: I also tried bulk_extractor, and it created a folder named "utmp_carved", with hashes and a lot of entries but there are no names, so I don't know what file I am actually looking for. If there is any way that I can recover the file or its hash this way instead of using volatility I could use it too.

  • Welcome to the community. Let's start from the start - did you download and use the same kernel used as in the image? Keep in mind that kernels only up to 5.5 are supported according to the documentation. Apr 3, 2023 at 17:51
  • Please refer to the documentation like github.com/volatilityfoundation/volatility/wiki/Linux If you prefer to use vol.py 3 which is strongly recommended please check out github.com/volatilityfoundation/volatility3 Apr 3, 2023 at 17:54
  • It is a college project so I have to use volatility 2 and the teacher give me the image so I guess there isn't any version problem
    – P00
    Apr 4, 2023 at 16:51
  • Did you download the kernel symbols as written in the documentation? Apr 4, 2023 at 17:42
  • I dind.t downlad anything, I am not creating a profile, I am just trying to analyze a given memory with a given profile and the volatility2. Is there any way to recover a deleted file?
    – P00
    Apr 5, 2023 at 13:27


Browse other questions tagged .