Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [volatility]

Volatility is a memory forensics framework that provides functionality to analyse memory dumps and to extract valueable information from it.

Filter by
Sorted by
Tagged with
1 vote
1 answer
889 views

How to identify hidden processes with volatility using psxview?

I was learning volatility and in this room in tryhackme they used psxview to find the hidden processes. The assignment was, It's fairly common for malware to attempt to hide itself and the process ...
user avatar
0 votes
1 answer
130 views

How to detect fileless kernel compromise in linux

Is there a way to detect fileless kernel compromise in Linux? The only one way to analyze this kind of attack is by volatility. Volatility is a very good product, but not often updated especially with ...
user avatar
  • 105
1 vote
0 answers
210 views

Finding NonPagedPool Start and End Address using volatility

I am exploiting bluekeep vulnerability in windows server 2008 R2 using metasploit framework. When I run the exploit windows/rdp/cve_2019_0708_bluekeep_rce, it ends in BSOD on server and then server ...
user avatar
  • 201
0 votes
1 answer
454 views

How to build Linux Volatility Profiles With the Compiled Kernel

I'm familiar with creating Linux memory profiles as stated here. However, this is assuming that I have access to the live system which often times is not the case. I heard there is a way to build the ...
user avatar
1 vote
0 answers
2k views

Why does Volatility fail on windows 10 dumps and what other tools can I use? [closed]

So I am trying to extract data from a full memory dump (Made with either dumpit or a BSOD). WinDBG manages to extract some information from it, but Volatility is silent: PS F:\> C:\Python27\python....
user avatar
  • 111
1 vote
0 answers
2k views

Volatility: Issue with analyzing Windows 10 and Server 2016 systems

I have been trying to use Volatility 2.6 to analyze memory dumps generated by DumpIt. I am experiencing an issue analyzing the memory dumps (all 4 GB in size) of two Windows 10 64 bit boxes (build ...
user avatar
  • 155
0 votes
1 answer
113 views

Is there any difference between hiberfile.sys file and RAM dump made with 3rd party software for Volatility.py?

I was wondering how could I give some advice to one of my friend when attempting to analyze live Windows machine which was infected with malware. As far as I know, hibernation saves RAM memory ...
user avatar
  • 76
1 vote
0 answers
297 views

Extracting passwords from Windows Credential Manager

I've read that when an encrypted zip file is opened using explorer, windows caches the passwords in the Credential Manager. Given the memory image of a machine where I've opened an encrypted zip, is ...
user avatar
0 votes
0 answers
1k views

How to analyze a split EnCase Image with Volatility?

I acquired a RAM image using EnCase so that I can run it through Volatility. The acquired image came as a split image (i.e. .E01, .E02, etc.). How can I combine all the individual files as one raw ...
user avatar
0 votes
0 answers
591 views

Volatility: Dumping memory associated with a particular process

I'm trying figure out how I can dump the memory associated with a process. So far, I've managed to identify the PID's of the processes I'm interested in (along with their offset). However, I can't ...
user avatar
3 votes
1 answer
131 views

Volatility.exe suggests two profiles for XP memory dump. Which one should I use?

Volatility suggests two profiles for XP memory dump. Which one should I use for further investigation? I am a beginner for the volatility.
user avatar
  • 33
4 votes
1 answer
3k views

Volatility Forensics with Large dumps

Today I was tasked with the analysis of a .vmem file of a Windows RDS one of our customers due to some "strange" connections coming from native Windows processes. The extracted .vmem file has a size ...
user avatar
  • 2,339
2 votes
0 answers
879 views

Extract Outlook email attachments from memory

Does anyone know if there is a way to extract Outlook emails with attachments from memory? What I have tried is to use volatility to dump PST files from memory and then use libpff to recover the ...
user avatar
  • 439
1 vote
0 answers
153 views

Volatility Plug-ins to investigate packed exe files

I am using volatility for malware analysis. I have got a process in my memory image that is packed by malware using UPX packer. Malfind plugin doesn't show injected code for it also. How can i use ...
user avatar
  • 11
4 votes
1 answer
1k views

Create memory dump from the windows commandline

I was following this blog post to dump the memory of a windows host. Sadly this method does not work on Windows Server 2012 because the memory drivers that come with mdd aren't signed and this is ...
user avatar
  • 4,275
3 votes
1 answer
713 views

Can a rootkit hide processes from "Volatility" or other memory forensics tools?

I know that a rootkit can hide processes from the OS by fooling around in the userspace. But can a rootkit also modify a processes metadata in a way that it won't even be recognized by a RAM forensic ...
user avatar
  • 4,275
5 votes
1 answer
13k views

Convert raw memory dump into a format recognized by volatility

I dumped the RAM of a Windows 7 pc using LiveKd which basicly worked. The memory was dumped but then the convert of the binary dump into "summary format" failed. When I then tried to read the file ...
user avatar
  • 4,275