Volatility 2

Image Identification:

  • imageinfo: Retrieve information about the memory image.

Process Analysis:

  • pslist: List running processes.
  • pstree: Display process tree.
  • cmdline: Extract command-line arguments of a process.
  • dlllist: List loaded DLLs for a process.
  • handles: List open handles for a process.

Memory Dumping:

  • memdump: Dump the memory of a specific process.

Registry Analysis:

  • hivelist: List registry hive offsets.
  • printkey: Print registry key values.
  • hashdump: Dump password hashes from the SAM database.

File Analysis:

  • filescan: Scan for file objects in memory.
  • mftparser: Parse the Master File Table (MFT) for file metadata.
  • dumpfiles: Extract files from memory.

Network Analysis:

  • connections: List network connections.
  • sockets: List open sockets.

Malware Analysis:

  • malfind: Find hidden or injected code.
  • malthfind: Find hidden processes.
  • ldrmodules: List loaded modules.

Timeline Analysis:

  • timeliner: Generate a timeline of system activity.
  • filescan: Scan for file objects with timestamps.

Volatility Configuration:

  • --plugins: Specify additional plugin directories.
  • --profile: Specify the profile of the memory image.

Volatility 3

Image Identification:

  • windows.info.Info: Retrieve information about the memory image.

Process Analysis:

  • windows.pslist.PsList: List running processes.
  • windows.pstree.PsTree: Display process tree.
  • windows.cmdline.CmdLine: Extract command-line arguments of a process.
  • windows.dlllist.DllList: List loaded DLLs for a process.
  • windows.handles.Handles: List open handles for a process.

Memory Dumping:

  • windows.memdump.MemDump: Dump the memory of a specific process.

Registry Analysis:

  • windows.registry.hivelist.HiveList: List registry hive offsets.
  • windows.registry.printkey.PrintKey: Print registry key values.
  • windows.registry.hive.Hive: Extract registry hive.

File Analysis:

  • windows.filescan.FileScan: Scan for file objects in memory.
  • windows.mftparser.MFTParser: Parse the Master File Table (MFT) for file metadata.
  • windows.dumpfiles.DumpFiles: Extract files from memory.

Network Analysis:

  • windows.netstat.Netstat: List network connections.
  • windows.sockets.Sockets: List open sockets.

Malware Analysis:

  • windows.malfind.Malfind: Find hidden or injected code.
  • windows.malthfind.Malthfind: Find hidden processes.
  • windows.modules.Modules: List loaded modules.

Timeline Analysis:

  • windows.timeline.Timeline: Generate a timeline of system activity.
  • windows.filescan.FileScan: Scan for file objects with timestamps.

Volatility Configuration:

  • --plugin-dirs: Specify additional plugin directories.
  • --profile: Specify the profile of the memory image.

Resources