Filter Volatility output with PowerShell Select-String
9
Find process handles with windows.handles
10
Dump a specific file from RAm with windows.dumpfile
11
Dump all files related to a PID
12
Check executable run options with windows.cmdline
13
Find active network connections with windows.netstat
14
Find local user password hash with windows.hashdump
15
Analyze user actions with windows.registry.userassist
16
Find and dump Registry hives from RAM with windows.registry.hivelist
17
Analyze a specific Registry key from RAM with windows.registry.printkey
18
Intro to Volatility 3 review
Description:
Learn how to perform memory forensics using Volatility 3 in this comprehensive tutorial video. Explore installation, basic commands, and essential analysis tasks including process listing, network connection checking, file extraction, and Windows Registry analysis. Follow along to master Volatility 3's command structure and extract critical information from memory dumps of Windows, macOS, and Linux systems. Gain practical skills in memory acquisition and analysis that are crucial for digital forensic investigations. By the end, you'll be equipped to leverage Volatility 3's powerful capabilities and tap into its extensive community of third-party plugins for advanced memory analysis.
Introduction to Memory Forensics with Volatility 3