Usage
Install: Plaso for timeline creation
Basic Commands
vol -f <FILENAME> --profile=<PROFILE> <PLUGIN> [ARGS]
Example:
vol -f ./memory.dmp windows.pslist
Plugins are always prefixed with for which platform it can be used on.
windows.**
linux.**
Output
Output needs to be done with shell redirect.
vol -f ./memory.dmp windows.pslist >> pslist.txt
Sometimes plugins have their own output setting
python3 vol.py -f mem.dump -o analysis timeliner --create-bodyfile
This will create a bodyfile under ./analysis/volatility.body
Extract running process (Binary)
Get a list of all running processes and their commandlines
python3 vol.py -f $dump windows.cmdline
Dump a specific PID
python3 vol.py -f $dump windows.pslist --pid 1136 --dump
Extract process memory
python3 vol.py -f $dump windows.memmap --pid {PID} --dump
Extract registry value
python3 vol.py -f $dump windows.registry.printkey -K "Software\Microsoft\Windows\CurrentVersion\Run"
Extract File
python3 vol.py -f $dump windows.dumpfiles --virtaddr {addr}
Pool Table scan
Pooltag.txt: https://github.com/jjzhang166/windbgtool/blob/master/Dependecies/x64/triage/pooltag.txt
Vol2
vol.exe -f $dump --profile=xxx pooltracker --tags=Proc,File,Driv,Thre
Vol3
python3 vol.py -f $dump windows.poolscanner
Network
Vol2
volatility –profile WinXPSP2x86 -f cridex.vmem sockets
volatility –profile WinXPSP2x86 -f cridex.vmem connscan