Skip to main content
3 votes
Accepted

Volatility.exe suggests two profiles for XP memory dump. Which one should I use?

You should try both! If memory addresses and PID's appear with question marks around them, you should probably switch to the other profile. The problem is volatility can recognize that it's a ...
Nomad's user avatar
  • 2,399
1 vote
Accepted

Volatility Forensics with Large dumps

Have you looked at rekall? It is a fork of volatility, while I have had better luck with volatility it might be faster for the initial analysis
jas-'s user avatar
  • 939
1 vote
Accepted

Can malware detect memory dumping?

Malware with sufficient access can do anything. Including adjusting your memory dump to “skip” its memory… or give. A different memory. As they say, as soon as it’s in…. All bets are off.
LvB's user avatar
  • 8,973
1 vote

How to extract a .bat file with volatility

The dump of the main memory (RAM) would only contain details about files that are in RAM, like those that are currently running. An NTFS system uses MFT to manage secondary storage, which is likely ...
Shawn M.'s user avatar
1 vote
Accepted

Are TPM PCRs volatile, non-volatile, or both?

The PCR's used for platform measurements in TPM are volatile. If you are looking for non-volatile memory with similar functionality to PCR's check for NV storage in TPM. They can be configured to work ...
saurabh's user avatar
  • 808
1 vote
Accepted

Is there any difference between hiberfile.sys file and RAM dump made with 3rd party software for Volatility.py?

When entering hibernation: Apps and services are notified Drivers are notified User and system state is saved to disk in a compressed format Firmware is notified (Per Microsoft's documenation on ...
DoubleD's user avatar
  • 3,952

Only top scored, non community-wiki answers of a minimum length are eligible