Questions tagged [volatility]

Volatility is a memory forensics framework that provides functionality to analyse memory dumps and to extract valueable information from it.

Filter by
Sorted by
Tagged with
1
vote
0answers
66 views

Extracting passwords from Windows Credential Manager

I've read that when an encrypted zip file is opened using explorer, windows caches the passwords in the Credential Manager. Given the memory image of a machine where I've opened an encrypted zip, is ...
0
votes
0answers
132 views

How to analyze a split EnCase Image with Volatility?

I acquired a RAM image using EnCase so that I can run it through Volatility. The acquired image came as a split image (i.e. .E01, .E02, etc.). How can I combine all the individual files as one raw ...
0
votes
0answers
52 views

Volatility: Dumping memory associated with a particular process

I'm trying figure out how I can dump the memory associated with a process. So far, I've managed to identify the PID's of the processes I'm interested in (along with their offset). However, I can't ...
0
votes
0answers
136 views

Why do i get so many ADD [EAX], AL assembly in the output of malfind in volatility? (Memory Forensics)

I have a memory dump, and it has some malware in it and when i use the malfind command, almost all of the processes that it shows have a LOT of ADD [EAX], AL assembly commands, i know x86 but i don't ...
3
votes
1answer
58 views

Volatility.exe suggests two profiles for XP memory dump. Which one should I use?

Volatility suggests two profiles for XP memory dump. Which one should I use for further investigation? I am a beginner for the volatility.
4
votes
1answer
536 views

Volatility Forensics with Large dumps

Today I was tasked with the analysis of a .vmem file of a Windows RDS one of our customers due to some "strange" connections coming from native Windows processes. The extracted .vmem file has a size ...
1
vote
0answers
516 views

Extract Outlook email attachments from memory

Does anyone know if there is a way to extract Outlook emails with attachments from memory? What I have tried is to use volatility to dump PST files from memory and then use libpff to recover the ...
1
vote
0answers
102 views

Volatility Plug-ins to investigate packed exe files

I am using volatility for malware analysis. I have got a process in my memory image that is packed by malware using UPX packer. Malfind plugin doesn't show injected code for it also. How can i use ...
4
votes
1answer
768 views

Create memory dump from the windows commandline

I was following this blog post to dump the memory of a windows host. Sadly this method does not work on Windows Server 2012 because the memory drivers that come with mdd aren't signed and this is ...
3
votes
1answer
494 views

Can a rootkit hide processes from “Volatility” or other memory forensics tools?

I know that a rootkit can hide processes from the OS by fooling around in the userspace. But can a rootkit also modify a processes metadata in a way that it won't even be recognized by a RAM forensic ...
5
votes
1answer
9k views

Convert raw memory dump into a format recognized by volatility

I dumped the RAM of a Windows 7 pc using LiveKd which basicly worked. The memory was dumped but then the convert of the binary dump into "summary format" failed. When I then tried to read the file ...