{"id":1390,"date":"2015-10-21T21:45:03","date_gmt":"2015-10-21T21:45:03","guid":{"rendered":"http:\/\/tech-no.104.210.61.21.xip.io\/?p=1390"},"modified":"2015-10-21T21:47:36","modified_gmt":"2015-10-21T21:47:36","slug":"volatility-an-advanced-memory-forensics-framework","status":"publish","type":"post","link":"https:\/\/tech-no.org\/?p=1390","title":{"rendered":"Volatility &#8211; An advanced memory forensics framework"},"content":{"rendered":"<p><a href=\"http:\/\/tech-no.104.210.61.21.xip.io\/?attachment_id=1392\" rel=\"attachment wp-att-1392\"><img loading=\"lazy\" class=\"size-full wp-image-1392 alignleft\" src=\"http:\/\/tech-no.104.210.61.21.xip.io\/wp-content\/uploads\/sites\/4\/2015\/10\/volatility.png\" alt=\"volatility\" width=\"200\" height=\"200\" srcset=\"https:\/\/tech-no.org\/wp-content\/uploads\/sites\/4\/2015\/10\/volatility.png 200w, https:\/\/tech-no.org\/wp-content\/uploads\/sites\/4\/2015\/10\/volatility-150x150.png 150w, https:\/\/tech-no.org\/wp-content\/uploads\/sites\/4\/2015\/10\/volatility-75x75.png 75w, https:\/\/tech-no.org\/wp-content\/uploads\/sites\/4\/2015\/10\/volatility-125x125.png 125w\" sizes=\"(max-width: 200px) 100vw, 200px\" \/><\/a>Are you involved in an Incident response engagement and need some free tools to complete your job? I have had good luck with Volatility Framework used in conjunction with Hibernation of the suspect endpoint.<\/p>\n<p>The <b>Volatility Framework<\/b> is a collection of tools, implemented in Python under the GNU General Public License (GPL v2), for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.<\/p>\n<p>Get it here:<\/p>\n<p><a href=\"https:\/\/github.com\/volatilityfoundation\" target=\"_blank\">https:\/\/github.com\/volatilityfoundation<\/a><\/p>\n<p>Volatility supports memory dumps from all major 32- and 64-bit Windows versions and service packs including XP, 2003 Server, Vista, Server 2008, Server 2008 <tt>R2<\/tt>, Seven, 8, 8.1, Server 2012, and 2012 <tt>R2<\/tt>. Whether your memory dump is in raw format, a Microsoft crash dump, hibernation file, or virtual machine snapshot, Volatility is able to work with it. We also now support Linux memory dumps in raw or LiME format and include 35+ plugins for analyzing 32- and 64-bit Linux kernels from 2.6.11 &#8211; 3.16 and distributions such as Debian, Ubuntu, OpenSuSE, Fedora, CentOS, and Mandrake. We support 38 versions of Mac OSX memory dumps from 10.5 to 10.9.4 Mavericks, both 32- and 64-bit. Android phones with ARM processors are also supported.<\/p>\n<p>Recommended Reading on the subject:<\/p>\n<p><a href=\"http:\/\/www.amazon.com\/The-Art-Memory-Forensics-Detecting\/dp\/1118825098\" target=\"_blank\">http:\/\/www.amazon.com\/The-Art-Memory-Forensics-Detecting\/dp\/1118825098<\/a><\/p>\n<p>Download the CheatSheet here:<\/p>\n<p>New one is here:<\/p>\n<p><a href=\"http:\/\/volatility-labs.blogspot.com\/2014\/08\/new-volatility-24-cheet-sheet-with.html\" target=\"_blank\">http:\/\/volatility-labs.blogspot.com\/2014\/08\/new-volatility-24-cheet-sheet-with.html<\/a><\/p>\n<p>Old one is here:<\/p>\n<p><a href=\"https:\/\/code.google.com\/p\/volatility\/downloads\/detail?name=CheatSheet_v2.3.pdf\" target=\"_blank\">https:\/\/code.google.com\/p\/volatility\/downloads\/detail?name=CheatSheet_v2.3.pdf<\/a><\/p>\n<p>Other Malware Analyst tools here:<\/p>\n<p><a href=\"http:\/\/www.malwarecookbook.com\/\" target=\"_blank\">http:\/\/www.malwarecookbook.com\/<\/a><\/p>\n<p>Submit Malware for Analysis<\/p>\n<p><a href=\"https:\/\/malwr.com\/submission\/\" target=\"_blank\">https:\/\/malwr.com\/submission\/<\/a><\/p>\n<p><a href=\"https:\/\/www.virustotal.com\/\" target=\"_blank\">https:\/\/www.virustotal.com\/<\/a><\/p>\n<p>Setup an automated Malware Analysis Lab<\/p>\n<p><a href=\"http:\/\/www.cuckoosandbox.org\/\" target=\"_blank\">http:\/\/www.cuckoosandbox.org\/<\/a><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Are you involved in an Incident response engagement and need some free tools to complete your job? I have had good luck with Volatility Framework used in conjunction with Hibernation of the suspect endpoint. The Volatility Framework is a collection of tools, implemented in Python under the GNU General Public License (GPL v2), for the &hellip;<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[],"_links":{"self":[{"href":"https:\/\/tech-no.org\/index.php?rest_route=\/wp\/v2\/posts\/1390"}],"collection":[{"href":"https:\/\/tech-no.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tech-no.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tech-no.org\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/tech-no.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1390"}],"version-history":[{"count":3,"href":"https:\/\/tech-no.org\/index.php?rest_route=\/wp\/v2\/posts\/1390\/revisions"}],"predecessor-version":[{"id":1394,"href":"https:\/\/tech-no.org\/index.php?rest_route=\/wp\/v2\/posts\/1390\/revisions\/1394"}],"wp:attachment":[{"href":"https:\/\/tech-no.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tech-no.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1390"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tech-no.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}