mirror of
https://github.com/tldr-pages/tldr.git
synced 2025-07-04 02:55:23 +02:00
26 lines
774 B
Markdown
26 lines
774 B
Markdown
|
# vol.py
|
||
|
|
|
||
|
|
> Forensics framework used to analyze volatile memory (RAM) dumps.
|
||
|
|
> With volatility3, plugins are now based on operating system. Examples below will use Windows.
|
||
|
|
> More information: <https://volatility3.readthedocs.io/en/latest/index.html>.
|
||
|
|
|
||
|
|
- Get information about a memory dump file:
|
||
|
|
|
||
|
|
`python3 vol.py {{[-f|--filename]}} {{path/to/memory_dump_file}} windows.info`
|
||
|
|
|
||
|
|
- List active processes:
|
||
|
|
|
||
|
|
`python3 vol.py {{[-f|--filename]}} {{path/to/memory_dump_file}} windows.pslist`
|
||
|
|
|
||
|
|
- List hashes of users on system:
|
||
|
|
|
||
|
|
`python3 vol.py {{[-f|--filename]}} {{path/to/memory_dump_file}} windows.hashdump`
|
||
|
|
|
||
|
|
- List active network connections:
|
||
|
|
|
||
|
|
`python3 vol.py {{[-f|--filename]}} {{path/to/memory_dump_file}} windows.netstat`
|
||
|
|
|
||
|
|
- Display help:
|
||
|
|
|
||
|
|
`python3 vol.py {{[-h|--help]}}`
|