Volatility

This app implements a variety of <b>investigative</b> actions on the <b>Volatility forensics analysis platform</b>.

Supported Actions

• list processes: Queries the system memory dump file for a list of processes and their information
• get process file: Extracts the process file from the memory dump
• list drivers: Execute the driverscan volatility plugin to list loaded drivers
• list mutexes: Execute the mutantscan volatility plugin to list mutexes
• list open files: Execute the filescan volatility plugin to list open files
• find malware: Execute the malfind volatility plugin to find injected code/dlls in user mode memory
• list sockets: Execute the sockscan volatility plugin. This command is only available on Windows XP and Windows 2003 Server.
• list connections: Execute the netscan or connscan volatility plugin to list network connections
• get browser history: Execute the iehistory volatility plugin
• list mrus: Execute the shellbags volatility plugin to get a list of MRUs (Most recently used items)
• get timeline: Execute the timeliner volatility plugin
• get command history: Execute the cmdscan volatility plugin
• get registry key: Execute the printkey volatility plugin
• list mfts: Execute the mftparser volatility plugin to get a list of master file table entries
• get registry hives: Execute the hivelist volatility plugin to get a list of registry hives