Skip to main content

Questions tagged [volatility]

Volatility is a memory forensics framework that provides functionality to analyse memory dumps and to extract valueable information from it.

Filter by
Sorted by
Tagged with
3 votes
1 answer
953 views

Can a rootkit hide processes from "Volatility" or other memory forensics tools?

I know that a rootkit can hide processes from the OS by fooling around in the userspace. But can a rootkit also modify a processes metadata in a way that it won't even be recognized by a RAM forensic ...
davidb's user avatar
  • 4,323