Installing and Using Volatility 2 on Windows
Last updated
Last updated
Volatility 2 is powerful memory forensics tool that allows for the extraction of digital artifacts from volatile memory (RAM).
Volatility was initially built on Python 2.7, however it is possible to download and use the standalone executable version directly from the .
In the , download the win64 standalone file.
Extract the ZIP file to desired location and verify if the standalone executable works by running the executable with -h option to display help page and list all available options:
Volatility 2 works on the basis of profiles where profile must be specified for the give memory dump file in order to use some of the processing options and extract the artifacts. Another requirement is specifying the memory image file which can be achieved with -f option. And finally, plugin commands are in charge of the actual processing of the memory image and retrieving the artifacts. The final syntax looks like the following:
As first, it is important to find out what profile should be used for the given memory dump file. This can be achieved by using imageinfo plugin:
Plugin imageinfo retrieves multiple information about the memory image file like data and time when image was taken, number of processors, etc. However the most important information is the Suggested Profile(s) section, where usually the first on the list is the correct profile to be used with the given memory image file.
Plugin pstree extracts running processes from the memory and displays the list of these processes in tree-like structure. Information about the processes include name, PID, Parent PID, number of threads and handles, and time when the process was started.
Plugin memdump dumps the whole addressable memory for the specified process. This plugin needs to point to specific process either via process name (-n) or PID (-p). Additionally, -D option specifies the directory to which the memory (.dmp file) should be dumped. The final syntax looks like the following:
The dumped memory (.dmp file) can be further analyzed with tools like strings to find malicious indicators and other artifacts within the memory of the dumped process.
This plugin finds file objects in physical memory and outputs physical offset address, number of pointers, number of handles, file permissions and file path.
This plugin can be used to look for specific file names within the memory when used together with grep or Select-String outlet when using PowerShell. For example, if looking for file called malicious.exe, the following syntax can be used:
Displays subkeys, values, data and data types of specified registry key. This plugin looks up the information for the specified key in all hives and displays what was found. The key is specified with -K option and full syntax is:
Used for displaying the open handles in running processes. The handles include files, registry keys, mutexes, named pipes, events, window stations, desktops, threads, etc.
This plugin can be used to extract and decrypt cached credentials from the registry. For this to happen, two options are required:
-y to specify virtual address of the SYSTEM hive
-s to specify virtual address of the SAM hive
Used for finding the physical and virtual addresses of registry hives in memory. This plugin displays virtual and physical address together with the full path to the corresponding hive.
Used for scanning the MFT entries in memory and displaying the information like file name, file path and mac timestamps. Two options are especially important:
--output= can be used to specify the type of output, for example text
--output-file= can be used to specify the output file
This plugin is used to scan for network artifacts within the memory. It displays both TCP and UDP connections and listeners as well as the process owner of the connection and corresponding PID.
Finds commands executed on the system via cmd.exe. This plugin displays both input and output of the command that was executed on the system as well as additional information like console window title, name of the process and PID, and aliases associated with the executed commands.
This plugin recovers artifacts from Internet Explorer history cache files. It displays accessed links and redirected links, together with information like related process name and its PID.
Finds hidden and injected code and DLLs within the memory. This can be used to identify malware that uses process injection to inject commands in the other running processes. Identified memory segments can be extracted with -D option which specifies the output directory while -p is used to specify the PID.
Used for extracting/dumping the files from the memory. Easiest way to use this plugin is to provide physical offset value with -Q option and path to the output directory where the file should be dumped with -D option. To find the physical offset value of the file to be dumped, plugin can be used. The syntax is:
This can be used to display , as handles comes with the -t option that can be used to look for mutexes only. The syntax for finding the mutex/mutant within the suspicious process is:
The virtual addresses for these hives can be found with plugin. The final syntax looks like the following:
