5 votes
Accepted

Can a rootkit hide processes from "Volatility" or other memory forensics tools?

But can a rootkit also modify a processes metadata in a way that it won't even be recognized by a RAM forensic tool like volatility? The short answer is, not really. Rootkits routinely change ...
gowenfawr's user avatar
  • 72.8k
3 votes
Accepted

Convert raw memory dump into a format recognized by volatility

By default, LiveKD acquires a kernel memory dump that appears as a crash dump file, not a complete raw dump of the contents of RAM. Volatility requires a complete memory dump. I recommend any of these ...
Dan's user avatar
  • 155
3 votes
Accepted

Volatility.exe suggests two profiles for XP memory dump. Which one should I use?

You should try both! If memory addresses and PID's appear with question marks around them, you should probably switch to the other profile. The problem is volatility can recognize that it's a ...
Nomad's user avatar
  • 2,369
1 vote
Accepted

Can malware detect memory dumping?

Malware with sufficient access can do anything. Including adjusting your memory dump to “skip” its memory… or give. A different memory. As they say, as soon as it’s in…. All bets are off.
LvB's user avatar
  • 8,943
1 vote

How to extract a .bat file with volatility

The dump of the main memory (RAM) would only contain details about files that are in RAM, like those that are currently running. An NTFS system uses MFT to manage secondary storage, which is likely ...
Shawn M.'s user avatar
1 vote
Accepted

Are TPM PCRs volatile, non-volatile, or both?

The PCR's used for platform measurements in TPM are volatile. If you are looking for non-volatile memory with similar functionality to PCR's check for NV storage in TPM. They can be configured to work ...
saurabh's user avatar
  • 797
1 vote
Accepted

Is there any difference between hiberfile.sys file and RAM dump made with 3rd party software for Volatility.py?

When entering hibernation: Apps and services are notified Drivers are notified User and system state is saved to disk in a compressed format Firmware is notified (Per Microsoft's documenation on ...
DoubleD's user avatar
  • 3,942
1 vote
Accepted

Volatility Forensics with Large dumps

Have you looked at rekall? It is a fork of volatility, while I have had better luck with volatility it might be faster for the initial analysis
jas-'s user avatar
  • 939
1 vote
Accepted

Create memory dump from the windows commandline

For doing a memory dump, you can use DumpIt and read the dump with volatility.
Sorcha's user avatar
  • 605

Only top scored, non community-wiki answers of a minimum length are eligible