<!DOCTYPE HTML>
<html lang="en" class="hacktricks-light sidebar-visible" dir="ltr">
    <head>
        <!-- Book generated using mdBook -->
        <meta charset="UTF-8">
        <title>Volatility - CheatSheet - HackTricks</title>

        <!-- Custom HTML head -->

        <meta name="description" content="">
        <meta name="viewport" content="width=device-width, initial-scale=1">
        <meta name="theme-color" content="#ffffff">

        <link rel="icon" href="../../../favicon.svg">
        <link rel="shortcut icon" href="../../../favicon.png">
        <link rel="stylesheet" href="../../../css/variables.css">
        <link rel="stylesheet" href="../../../css/general.css">
        <link rel="stylesheet" href="../../../css/chrome.css">

        <!-- Fonts -->
        <link rel="stylesheet" href="../../../FontAwesome/css/font-awesome.css">
        <link rel="stylesheet" href="../../../fonts/fonts.css">

        <!-- Highlight.js Stylesheets -->
        <link rel="stylesheet" href="../../../highlight.css">
        <link rel="stylesheet" href="../../../tomorrow-night.css">
        <link rel="stylesheet" href="../../../ayu-highlight.css">

        <!-- Custom theme stylesheets -->
        <link rel="stylesheet" href="../../../theme/pagetoc.css">
        <link rel="stylesheet" href="../../../theme/tabs.css">


        <!-- Provide site root to javascript -->
        <script>
            var path_to_root = "../../../";
            var lang = "en";
            var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "hacktricks-dark" : "hacktricks-light";
        </script>
        <!-- Start loading toc.js asap -->
        <script src="../../../toc.js"></script>
    </head>
    <body>
    <div id="body-container">
        <!-- Work around some values being stored in localStorage wrapped in quotes -->
        <script>
            try {
                var theme = localStorage.getItem('mdbook-theme');
                var sidebar = localStorage.getItem('mdbook-sidebar');

                if (theme.startsWith('"') && theme.endsWith('"')) {
                    localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1));
                }

                if (sidebar.startsWith('"') && sidebar.endsWith('"')) {
                    localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1));
                }
            } catch (e) { }
        </script>

        <!-- Set the theme before any content is loaded, prevents flash -->
        <script>
            var theme;
            try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { }
            if (theme === null || theme === undefined) { theme = default_theme; }
            const html = document.documentElement;
            html.classList.remove('hacktricks-light')
            html.classList.add(theme);
            html.classList.add("js");
        </script>

        <input type="checkbox" id="sidebar-toggle-anchor" class="hidden">

        <!-- Hide / unhide sidebar before it is displayed -->
        <script>
            var sidebar = null;
            var sidebar_toggle = document.getElementById("sidebar-toggle-anchor");
            var body = document.querySelector("body");
            if (document.body.clientWidth >= 550) {
                try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { }
                sidebar = sidebar || 'visible';
            } else {
                sidebar = 'hidden';
            }
            sidebar_toggle.checked = sidebar === 'visible';
            html.classList.remove('sidebar-visible');
            html.classList.add("sidebar-" + sidebar);
            body.classList.remove('sidebar-visible');
            body.classList.add("sidebar-" + sidebar);
        </script>

        <div id="page-wrapper" class="page-wrapper">
            <div id="search-wrapper" class="hidden">
                <div id="search-modal">
                    <form id="searchbar-outer" class="searchbar-outer">
                        <span class="fa fa-search"></span>
                        <input type="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header">
                    </form>
                    <div id="searchresults-outer" class="searchresults-outer hidden">
                        <div id="searchresults-header" class="searchresults-header"></div>
                        <ul id="searchresults">
                        </ul>
                    </div>
                </div>
            </div>

            <div class="page">
                <div id="menu-bar-hover-placeholder"></div>
                <div id="menu-bar" class="menu-bar sticky">
                    <div class="menu-bar-container">
                        <div class="left-buttons">
                            <label id="sidebar-toggle" class="icon-button" for="sidebar-toggle-anchor" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar">
                                <i class="fa fa-bars"></i>
                            </label>
                            <a href="/">
                                <h1 class="menu-title"><img src="../../../../../images/CLOUD-web-logo.png" alt="" style="width:auto;height:30px;vertical-align:middle;margin-right:5px;">HackTricks</h1>
                            </a>

                        </div>


                        <div class="right-buttons">
                            <div id="menubar-collapse">
                                <a class="menu-bar-link" href="https://training.hacktricks.xyz" target="_blank">
                                    Hacktricks Training
                                </a>
                                <a class="menu-bar-link" href="https://twitter.com/hacktricks_live" target="_blank">
                                    Twitter
                                </a>
                                <a class="menu-bar-link" href="https://www.linkedin.com/company/hacktricks" target="_blank">
                                    Linkedin
                                </a>
                                <a class="menu-bar-link" href="https://github.com/sponsors/carlospolop" target="_blank">
                                    Sponsor
                                </a>
                            </div>
                            <div class="icons">
                                <div id="menubar-collapse-toggle" class="icon-button" type="button" title="Toggle menu bar" aria-label="Toggle Menu bar" aria-expanded="false" aria-controls="collapse">
                                    <i class="fa fa-ellipsis-h"></i>
                                    <div id="menubar-collapse-popup" class="menubar-collapse-popup" aria-label="Menu" role="menu">
                                        <a href="https://training.hacktricks.xyz" target="_blank" role="menuitem" class="menu-bar-link">Hacktricks Training</a>
                                        <a href="https://twitter.com/hacktricks_live" target="_blank" role="menuitem" class="menu-bar-link">Twitter</a>
                                        <a href="https://www.linkedin.com/company/hacktricks" target="_blank" role="menuitem" class="menu-bar-link">Linkedin</a>
                                        <a href="https://github.com/sponsors/carlospolop" target="_blank" role="menuitem" class="menu-bar-link">Sponsor</a>
                                    </div>
                                </div>

                                <button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar">
                                    <i class="fa fa-search"></i>
                                </button>

                                <div id="menubar-languages-toggle" class="icon-button" type="button" title="Translations" aria-label="Toggle Tanslations" aria-expanded="false" aria-controls="translations">
                                    <i class="fa fa-globe"></i>
                                    <span class="menu-bar-link">Translations</span>
                                    
                                    <div id="menubar-languages-popup" class="menubar-languages-popup" aria-label="Language menu" role="language menu">
                                        <button id="af" role="menuitem" class="menu-bar-link">Afrikaans</button>
                                        <button id="zh" role="menuitem" class="menu-bar-link">Chinese</button>
                                        <button id="en" role="menuitem" class="menu-bar-link">English</button>
                                        <button id="fr" role="menuitem" class="menu-bar-link">French</button>
                                        <button id="de" role="menuitem" class="menu-bar-link">German</button>
                                        <button id="el" role="menuitem" class="menu-bar-link">Greek</button>
                                        <button id="hi" role="menuitem" class="menu-bar-link">Hindi</button>
                                        <button id="it" role="menuitem" class="menu-bar-link">Italian</button>
                                        <button id="ja" role="menuitem" class="menu-bar-link">Japanese</button>
                                        <button id="ko" role="menuitem" class="menu-bar-link">Korean</button>
                                        <button id="pl" role="menuitem" class="menu-bar-link">Polish</button>
                                        <button id="pt" role="menuitem" class="menu-bar-link">Portuguese</button>
                                        <button id="sr" role="menuitem" class="menu-bar-link">Serbian</button>
                                        <button id="es" role="menuitem" class="menu-bar-link">Spanish</button>
                                        <button id="sw" role="menuitem" class="menu-bar-link">Swahili</button>
                                        <button id="tr" role="menuitem" class="menu-bar-link">Turkish</button>
                                        <button id="uk" role="menuitem" class="menu-bar-link">Ukrainian</button>
                                    </div>
                                </div>
                            </div>


                        </div>
                    </div>
                </div>
                <div id="container" class="container">
                    <nav id="sidebar" class="sidebar" aria-label="Table of contents">
                        <!-- populated by js -->
                        <mdbook-sidebar-scrollbox class="sidebar-scrollbox"></mdbook-sidebar-scrollbox>
                        <noscript>
                            <iframe class="sidebar-iframe-outer" src="../../../toc.html"></iframe>
                        </noscript>
                    </nav>
                    <!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM -->
                    <script>
                        document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
                        document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
                        Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) {
                            link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1);
                        });
                    </script>

                    <div id="content" class="content">
                        <main>
                            <div class="mobilesponsor-wrapper">

                            <a class="mobilesponsor" href="" target="_blank">
                                <img src="" alt="" srcset="">
                                <div class="mobilesponsor-title">
                                </div>
                                <div class="mobilesponsor-description">
                                </div>
                                <div class="mobilesponsor-cta"></div>
                            </a>
                            </div>
                            <h1 id="volatility---cheatsheet"><a class="header" href="#volatility---cheatsheet">Volatility - CheatSheet</a></h1>
<blockquote>
<p>[!TIP]
Learn &amp; practice AWS Hacking:<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><a href="https://training.hacktricks.xyz/courses/arte"><strong>HackTricks Training AWS Red Team Expert (ARTE)</strong></a><img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><br />
Learn &amp; practice GCP Hacking: <img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><a href="https://training.hacktricks.xyz/courses/grte"><strong>HackTricks Training GCP Red Team Expert (GRTE)</strong></a><img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"></p>
<details>
<summary>Support HackTricks</summary>
<ul>
<li>Check the <a href="https://github.com/sponsors/carlospolop"><strong>subscription plans</strong></a>!</li>
<li><strong>Join the</strong> 💬 <a href="https://discord.gg/hRep4RUj7f"><strong>Discord group</strong></a> or the <a href="https://t.me/peass"><strong>telegram group</strong></a> or <strong>follow</strong> us on <strong>Twitter</strong> 🐦 <a href="https://twitter.com/hacktricks_live"><strong>@hacktricks_live</strong></a><strong>.</strong></li>
<li><strong>Share hacking tricks by submitting PRs to the</strong> <a href="https://github.com/carlospolop/hacktricks"><strong>HackTricks</strong></a> and <a href="https://github.com/carlospolop/hacktricks-cloud"><strong>HackTricks Cloud</strong></a> github repos.</li>
</ul>
</details>
</blockquote>
<p>​</p>
<p>If you need a tool that automates memory analysis with different scan levels and runs multiple Volatility3 plugins in parallel, you can use autoVolatility3:: <a href="https://github.com/H3xKatana/autoVolatility3/">https://github.com/H3xKatana/autoVolatility3/</a></p>
<pre><code class="language-bash"># Full scan (runs all plugins)
python3 autovol3.py -f MEMFILE -o OUT_DIR -s full

# Minimal scan (runs a limited set of plugins)
python3 autovol3.py -f MEMFILE -o OUT_DIR -s minimal

# Normal scan (runs a balanced set of plugins)
python3 autovol3.py -f MEMFILE -o OUT_DIR -s normal

</code></pre>
<p>If you want something <strong>fast and crazy</strong> that will launch several Volatility plugins on parallel you can use: <a href="https://github.com/carlospolop/autoVolatility">https://github.com/carlospolop/autoVolatility</a></p>
<pre><code class="language-bash">python autoVolatility.py -f MEMFILE -d OUT_DIRECTORY -e /home/user/tools/volatility/vol.py # It will use the most important plugins (could use a lot of space depending on the size of the memory)
</code></pre>
<h2 id="installation"><a class="header" href="#installation">Installation</a></h2>
<h3 id="volatility3"><a class="header" href="#volatility3">volatility3</a></h3>
<pre><code class="language-bash">git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
python3 setup.py install
python3 vol.py —h
</code></pre>
<h3 id="volatility2"><a class="header" href="#volatility2">volatility2</a></h3>
<p>{{#tabs}}
{{#tab name="Method1"}}</p>
<pre><code>Download the executable from https://www.volatilityfoundation.org/26
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Method 2"}}</p>
<pre><code class="language-bash">git clone https://github.com/volatilityfoundation/volatility.git
cd volatility
python setup.py install
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h2 id="volatility-commands"><a class="header" href="#volatility-commands">Volatility Commands</a></h2>
<p>Access the official doc in <a href="https://github.com/volatilityfoundation/volatility/wiki/Command-Reference#kdbgscan">Volatility command reference</a></p>
<h3 id="a-note-on-list-vs-scan-plugins"><a class="header" href="#a-note-on-list-vs-scan-plugins">A note on “list” vs. “scan” plugins</a></h3>
<p>Volatility has two main approaches to plugins, which are sometimes reflected in their names. “list” plugins will try to navigate through Windows Kernel structures to retrieve information like processes (locate and walk the linked list of <code>_EPROCESS</code> structures in memory), OS handles (locating and listing the handle table, dereferencing any pointers found, etc). They more or less behave like the Windows API would if requested to, for example, list processes.</p>
<p>That makes “list” plugins pretty fast, but just as vulnerable as the Windows API to manipulation by malware. For instance, if malware uses DKOM to unlink a process from the <code>_EPROCESS</code> linked list, it won’t show up in the Task Manager and neither will it in the pslist.</p>
<p>“scan” plugins, on the other hand, will take an approach similar to carving the memory for things that might make sense when dereferenced as specific structures. <code>psscan</code> for instance will read the memory and try to make<code>_EPROCESS</code> objects out of it (it uses pool-tag scanning, which is searching for 4-byte strings that indicate the presence of a structure of interest). The advantage is that it can dig up processes that have exited, and even if malware tampers with the <code>_EPROCESS</code> linked list, the plugin will still find the structure lying around in memory (since it still needs to exist for the process to run). The downfall is that “scan” plugins are a bit slower than “list” plugins, and can sometimes yield false positives (a process that exited too long ago and had parts of its structure overwritten by other operations).</p>
<p>From: <a href="http://tomchop.me/2016/11/21/tutorial-volatility-plugins-malware-analysis/">http://tomchop.me/2016/11/21/tutorial-volatility-plugins-malware-analysis/</a></p>
<h2 id="os-profiles"><a class="header" href="#os-profiles">OS Profiles</a></h2>
<h3 id="volatility3-1"><a class="header" href="#volatility3-1">Volatility3</a></h3>
<p>As explained inside the readme you need to put the <strong>symbol table of the OS</strong> you want to support inside <em>volatility3/volatility/symbols</em>.<br />
Symbol table packs for the various operating systems are available for <strong>download</strong> at:</p>
<ul>
<li><a href="https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip">https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip</a></li>
<li><a href="https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip">https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip</a></li>
<li><a href="https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip">https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip</a></li>
</ul>
<h3 id="volatility2-1"><a class="header" href="#volatility2-1">Volatility2</a></h3>
<h4 id="external-profile"><a class="header" href="#external-profile">External Profile</a></h4>
<p>You can get the list of supported profiles doing:</p>
<pre><code class="language-bash">./volatility_2.6_lin64_standalone --info | grep "Profile"
</code></pre>
<p>If you want to use a <strong>new profile you have downloaded</strong> (for example a linux one) you need to create somewhere the following folder structure: <em>plugins/overlays/linux</em> and put inside this folder the zip file containing the profile. Then, get the number of the profiles using:</p>
<pre><code class="language-bash">./vol --plugins=/home/kali/Desktop/ctfs/final/plugins --info
Volatility Foundation Volatility Framework 2.6


Profiles
--------
LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64 - A Profile for Linux CentOS7_3.10.0-123.el7.x86_64_profile x64
VistaSP0x64                                   - A Profile for Windows Vista SP0 x64
VistaSP0x86                                   - A Profile for Windows Vista SP0 x86
</code></pre>
<p>You can <strong>download Linux and Mac profiles</strong> from <a href="https://github.com/volatilityfoundation/profiles">https://github.com/volatilityfoundation/profiles</a></p>
<p>In the previous chunk you can see that the profile is called <code>LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64</code>, and you can use it to execute something like:</p>
<pre><code class="language-bash">./vol -f file.dmp --plugins=. --profile=LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64 linux_netscan
</code></pre>
<h4 id="discover-profile"><a class="header" href="#discover-profile">Discover Profile</a></h4>
<pre><code>volatility imageinfo -f file.dmp
volatility kdbgscan -f file.dmp
</code></pre>
<h4 id="differences-between-imageinfo-and-kdbgscan"><a class="header" href="#differences-between-imageinfo-and-kdbgscan"><strong>Differences between imageinfo and kdbgscan</strong></a></h4>
<p><a href="https://www.andreafortuna.org/2017/06/25/volatility-my-own-cheatsheet-part-1-image-identification/"><strong>From here</strong></a>: As opposed to imageinfo which simply provides profile suggestions, <strong>kdbgscan</strong> is designed to positively identify the correct profile and the correct KDBG address (if there happen to be multiple). This plugin scans for the KDBGHeader signatures linked to Volatility profiles and applies sanity checks to reduce false positives. The verbosity of the output and the number of sanity checks that can be performed depends on whether Volatility can find a DTB, so if you already know the correct profile (or if you have a profile suggestion from imageinfo), then make sure you use it from .</p>
<p>Always take a look at the <strong>number of processes that kdbgscan has found</strong>. Sometimes imageinfo and kdbgscan can find <strong>more than one</strong> suitable <strong>profile</strong> but only the <strong>valid one will have some process related</strong> (This is because to extract processes the correct KDBG address is needed)</p>
<pre><code class="language-bash"># GOOD
PsActiveProcessHead           : 0xfffff800011977f0 (37 processes)
PsLoadedModuleList            : 0xfffff8000119aae0 (116 modules)
</code></pre>
<pre><code class="language-bash"># BAD
PsActiveProcessHead           : 0xfffff800011947f0 (0 processes)
PsLoadedModuleList            : 0xfffff80001197ac0 (0 modules)
</code></pre>
<h4 id="kdbg"><a class="header" href="#kdbg">KDBG</a></h4>
<p>The <strong>kernel debugger block</strong>, referred to as <strong>KDBG</strong> by Volatility, is crucial for forensic tasks performed by Volatility and various debuggers. Identified as <code>KdDebuggerDataBlock</code> and of the type <code>_KDDEBUGGER_DATA64</code>, it contains essential references like <code>PsActiveProcessHead</code>. This specific reference points to the head of the process list, enabling the listing of all processes, which is fundamental for thorough memory analysis.</p>
<h2 id="os-information"><a class="header" href="#os-information">OS Information</a></h2>
<pre><code class="language-bash">#vol3 has a plugin to give OS information (note that imageinfo from vol2 will give you OS info)
./vol.py -f file.dmp windows.info.Info
</code></pre>
<p>The plugin <code>banners.Banners</code> can be used in <strong>vol3 to try to find linux banners</strong> in the dump.</p>
<h2 id="hashespasswords"><a class="header" href="#hashespasswords">Hashes/Passwords</a></h2>
<p>Extract SAM hashes, <a href="../../../windows-hardening/stealing-credentials/credentials-protections.html#cached-credentials">domain cached credentials</a> and <a href="../../../windows-hardening/authentication-credentials-uac-and-efs/index.html#lsa-secrets">lsa secrets</a>.</p>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py -f file.dmp windows.hashdump.Hashdump #Grab common windows hashes (SAM+SYSTEM)
./vol.py -f file.dmp windows.cachedump.Cachedump #Grab domain cache hashes inside the registry
./vol.py -f file.dmp windows.lsadump.Lsadump #Grab lsa secrets
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 hashdump -f file.dmp #Grab common windows hashes (SAM+SYSTEM)
volatility --profile=Win7SP1x86_23418 cachedump -f file.dmp #Grab domain cache hashes inside the registry
volatility --profile=Win7SP1x86_23418 lsadump -f file.dmp #Grab lsa secrets
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h2 id="memory-dump"><a class="header" href="#memory-dump">Memory Dump</a></h2>
<p>The memory dump of a process will <strong>extract everything</strong> of the current status of the process. The <strong>procdump</strong> module will only <strong>extract</strong> the <strong>code</strong>.</p>
<pre><code>volatility -f file.dmp --profile=Win7SP1x86 memdump -p 2168 -D conhost/
</code></pre>
<h2 id="processes"><a class="header" href="#processes">Processes</a></h2>
<h3 id="list-processes"><a class="header" href="#list-processes">List processes</a></h3>
<p>Try to find <strong>suspicious</strong> processes (by name) or <strong>unexpected</strong> child <strong>processes</strong> (for example a cmd.exe as a child of iexplorer.exe).<br />
It could be interesting to <strong>compare</strong> the result of pslist with the one of psscan to identify hidden processes.</p>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">python3 vol.py -f file.dmp windows.pstree.PsTree # Get processes tree (not hidden)
python3 vol.py -f file.dmp windows.pslist.PsList # Get process list (EPROCESS)
python3 vol.py -f file.dmp windows.psscan.PsScan # Get hidden process list(malware)
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=PROFILE pstree -f file.dmp # Get process tree (not hidden)
volatility --profile=PROFILE pslist -f file.dmp # Get process list (EPROCESS)
volatility --profile=PROFILE psscan -f file.dmp # Get hidden process list(malware)
volatility --profile=PROFILE psxview -f file.dmp # Get hidden process list
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="dump-proc"><a class="header" href="#dump-proc">Dump proc</a></h3>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py -f file.dmp windows.dumpfiles.DumpFiles --pid &lt;pid&gt; #Dump the .exe and dlls of the process in the current directory
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 procdump --pid=3152 -n --dump-dir=. -f file.dmp
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="command-line"><a class="header" href="#command-line">Command line</a></h3>
<p>Anything suspicious was executed?</p>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">python3 vol.py -f file.dmp windows.cmdline.CmdLine #Display process command-line arguments
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=PROFILE cmdline -f file.dmp #Display process command-line arguments
volatility --profile=PROFILE consoles -f file.dmp #command history by scanning for _CONSOLE_INFORMATION
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<p>Commands executed in <code>cmd.exe</code> are managed by <strong><code>conhost.exe</code></strong> (or <code>csrss.exe</code> on systems before Windows 7). This means that if <strong><code>cmd.exe</code></strong> is terminated by an attacker before a memory dump is obtained, it's still possible to recover the session's command history from the memory of <strong><code>conhost.exe</code></strong>. To do this, if unusual activity is detected within the console's modules, the memory of the associated <strong><code>conhost.exe</code></strong> process should be dumped. Then, by searching for <strong>strings</strong> within this dump, command lines used in the session can potentially be extracted.</p>
<h3 id="environment"><a class="header" href="#environment">Environment</a></h3>
<p>Get the env variables of each running process. There could be some interesting values.</p>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">python3 vol.py -f file.dmp windows.envars.Envars [--pid &lt;pid&gt;] #Display process environment variables
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=PROFILE envars -f file.dmp [--pid &lt;pid&gt;] #Display process environment variables

volatility --profile=PROFILE -f file.dmp linux_psenv [-p &lt;pid&gt;] #Get env of process. runlevel var means the runlevel where the proc is initated
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="token-privileges"><a class="header" href="#token-privileges">Token privileges</a></h3>
<p>Check for privileges tokens in unexpected services.<br />
It could be interesting to list the processes using some privileged token.</p>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">#Get enabled privileges of some processes
python3 vol.py -f file.dmp windows.privileges.Privs [--pid &lt;pid&gt;]
#Get all processes with interesting privileges
python3 vol.py -f file.dmp windows.privileges.Privs | grep "SeImpersonatePrivilege\|SeAssignPrimaryPrivilege\|SeTcbPrivilege\|SeBackupPrivilege\|SeRestorePrivilege\|SeCreateTokenPrivilege\|SeLoadDriverPrivilege\|SeTakeOwnershipPrivilege\|SeDebugPrivilege"
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">#Get enabled privileges of some processes
volatility --profile=Win7SP1x86_23418 privs --pid=3152 -f file.dmp | grep Enabled
#Get all processes with interesting privileges
volatility --profile=Win7SP1x86_23418 privs -f file.dmp | grep "SeImpersonatePrivilege\|SeAssignPrimaryPrivilege\|SeTcbPrivilege\|SeBackupPrivilege\|SeRestorePrivilege\|SeCreateTokenPrivilege\|SeLoadDriverPrivilege\|SeTakeOwnershipPrivilege\|SeDebugPrivilege"
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="sids"><a class="header" href="#sids">SIDs</a></h3>
<p>Check each SSID owned by a process.<br />
It could be interesting to list the processes using a privileges SID (and the processes using some service SID).</p>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py -f file.dmp windows.getsids.GetSIDs [--pid &lt;pid&gt;] #Get SIDs of processes
./vol.py -f file.dmp windows.getservicesids.GetServiceSIDs #Get the SID of services
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 getsids -f file.dmp #Get the SID owned by each process
volatility --profile=Win7SP1x86_23418 getservicesids -f file.dmp #Get the SID of each service
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="handles"><a class="header" href="#handles">Handles</a></h3>
<p>Useful to know to which other files, keys, threads, processes... a <strong>process has a handle</strong> for (has opened)</p>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">vol.py -f file.dmp windows.handles.Handles [--pid &lt;pid&gt;]
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 -f file.dmp handles [--pid=&lt;pid&gt;]
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="dlls"><a class="header" href="#dlls">DLLs</a></h3>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py -f file.dmp windows.dlllist.DllList [--pid &lt;pid&gt;] #List dlls used by each
./vol.py -f file.dmp windows.dumpfiles.DumpFiles --pid &lt;pid&gt; #Dump the .exe and dlls of the process in the current directory process
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 dlllist --pid=3152 -f file.dmp #Get dlls of a proc
volatility --profile=Win7SP1x86_23418 dlldump --pid=3152 --dump-dir=. -f file.dmp #Dump dlls of a proc
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="strings-per-processes"><a class="header" href="#strings-per-processes">Strings per processes</a></h3>
<p>Volatility allows us to check which process a string belongs to.</p>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">strings file.dmp &gt; /tmp/strings.txt
./vol.py -f /tmp/file.dmp windows.strings.Strings --strings-file /tmp/strings.txt
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">strings file.dmp &gt; /tmp/strings.txt
volatility -f /tmp/file.dmp windows.strings.Strings --string-file /tmp/strings.txt

volatility -f /tmp/file.dmp --profile=Win81U1x64 memdump -p 3532 --dump-dir .
strings 3532.dmp &gt; strings_file
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<p>It also allows to search for strings inside a process using the yarascan module:</p>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py -f file.dmp windows.vadyarascan.VadYaraScan --yara-rules "https://" --pid 3692 3840 3976 3312 3084 2784
./vol.py -f file.dmp yarascan.YaraScan --yara-rules "https://"
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 yarascan -Y "https://" -p 3692,3840,3976,3312,3084,2784
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="userassist"><a class="header" href="#userassist">UserAssist</a></h3>
<p><strong>Windows</strong> keeps track of programs you run using a feature in the registry called <strong>UserAssist keys</strong>. These keys record how many times each program is executed and when it was last run.</p>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py -f file.dmp windows.registry.userassist.UserAssist
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code>volatility --profile=Win7SP1x86_23418 -f file.dmp userassist
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<p>​</p>
<h2 id="services"><a class="header" href="#services">Services</a></h2>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py -f file.dmp windows.svcscan.SvcScan #List services
./vol.py -f file.dmp windows.getservicesids.GetServiceSIDs #Get the SID of services
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">#Get services and binary path
volatility --profile=Win7SP1x86_23418 svcscan -f file.dmp
#Get name of the services and SID (slow)
volatility --profile=Win7SP1x86_23418 getservicesids -f file.dmp
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h2 id="network"><a class="header" href="#network">Network</a></h2>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py -f file.dmp windows.netscan.NetScan
#For network info of linux use volatility2
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 netscan -f file.dmp
volatility --profile=Win7SP1x86_23418 connections -f file.dmp#XP and 2003 only
volatility --profile=Win7SP1x86_23418 connscan -f file.dmp#TCP connections
volatility --profile=Win7SP1x86_23418 sockscan -f file.dmp#Open sockets
volatility --profile=Win7SP1x86_23418 sockets -f file.dmp#Scanner for tcp socket objects

volatility --profile=SomeLinux -f file.dmp linux_ifconfig
volatility --profile=SomeLinux -f file.dmp linux_netstat
volatility --profile=SomeLinux -f file.dmp linux_netfilter
volatility --profile=SomeLinux -f file.dmp linux_arp #ARP table
volatility --profile=SomeLinux -f file.dmp linux_list_raw #Processes using promiscuous raw sockets (comm between processes)
volatility --profile=SomeLinux -f file.dmp linux_route_cache
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h2 id="registry-hive"><a class="header" href="#registry-hive">Registry hive</a></h2>
<h3 id="print-available-hives"><a class="header" href="#print-available-hives">Print available hives</a></h3>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py -f file.dmp windows.registry.hivelist.HiveList #List roots
./vol.py -f file.dmp windows.registry.printkey.PrintKey #List roots and get initial subkeys
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 -f file.dmp hivelist #List roots
volatility --profile=Win7SP1x86_23418 -f file.dmp printkey #List roots and get initial subkeys
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="get-a-value"><a class="header" href="#get-a-value">Get a value</a></h3>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py -f file.dmp windows.registry.printkey.PrintKey --key "Software\Microsoft\Windows NT\CurrentVersion"
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 printkey -K "Software\Microsoft\Windows NT\CurrentVersion" -f file.dmp
# Get Run binaries registry value
volatility -f file.dmp --profile=Win7SP1x86 printkey -o 0x9670e9d0 -K 'Software\Microsoft\Windows\CurrentVersion\Run'
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="dump"><a class="header" href="#dump">Dump</a></h3>
<pre><code class="language-bash">#Dump a hive
volatility --profile=Win7SP1x86_23418 hivedump -o 0x9aad6148 -f file.dmp #Offset extracted by hivelist
#Dump all hives
volatility --profile=Win7SP1x86_23418 hivedump -f file.dmp
</code></pre>
<h2 id="filesystem"><a class="header" href="#filesystem">Filesystem</a></h2>
<h3 id="mount"><a class="header" href="#mount">Mount</a></h3>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">#See vol2
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=SomeLinux -f file.dmp linux_mount
volatility --profile=SomeLinux -f file.dmp linux_recover_filesystem #Dump the entire filesystem (if possible)
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="scandump"><a class="header" href="#scandump">Scan/dump</a></h3>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py -f file.dmp windows.filescan.FileScan #Scan for files inside the dump
./vol.py -f file.dmp windows.dumpfiles.DumpFiles --physaddr &lt;0xAAAAA&gt; #Offset from previous command
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 filescan -f file.dmp #Scan for files inside the dump
volatility --profile=Win7SP1x86_23418 dumpfiles -n --dump-dir=/tmp -f file.dmp #Dump all files
volatility --profile=Win7SP1x86_23418 dumpfiles -n --dump-dir=/tmp -Q 0x000000007dcaa620 -f file.dmp

volatility --profile=SomeLinux -f file.dmp linux_enumerate_files
volatility --profile=SomeLinux -f file.dmp linux_find_file -F /path/to/file
volatility --profile=SomeLinux -f file.dmp linux_find_file -i 0xINODENUMBER -O /path/to/dump/file
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="master-file-table"><a class="header" href="#master-file-table">Master File Table</a></h3>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash"># I couldn't find any plugin to extract this information in volatility3
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 mftparser -f file.dmp
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<p>The <strong>NTFS file system</strong> uses a critical component known as the <em>master file table</em> (MFT). This table includes at least one entry for every file on a volume, covering the MFT itself too. Vital details about each file, such as <strong>size, timestamps, permissions, and actual data</strong>, are encapsulated within the MFT entries or in areas external to the MFT but referenced by these entries. More details can be found in the <a href="https://docs.microsoft.com/en-us/windows/win32/fileio/master-file-table">official documentation</a>.</p>
<h3 id="ssl-keyscerts"><a class="header" href="#ssl-keyscerts">SSL Keys/Certs</a></h3>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">#vol3 allows to search for certificates inside the registry
./vol.py -f file.dmp windows.registry.certificates.Certificates
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">#vol2 allos you to search and dump certificates from memory
#Interesting options for this modules are: --pid, --name, --ssl
volatility --profile=Win7SP1x86_23418 dumpcerts --dump-dir=. -f file.dmp
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h2 id="malware"><a class="header" href="#malware">Malware</a></h2>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py -f file.dmp windows.malfind.Malfind [--dump] #Find hidden and injected code, [dump each suspicious section]
#Malfind will search for suspicious structures related to malware
./vol.py -f file.dmp windows.driverirp.DriverIrp #Driver IRP hook detection
./vol.py -f file.dmp windows.ssdt.SSDT #Check system call address from unexpected addresses

./vol.py -f file.dmp linux.check_afinfo.Check_afinfo #Verifies the operation function pointers of network protocols
./vol.py -f file.dmp linux.check_creds.Check_creds #Checks if any processes are sharing credential structures
./vol.py -f file.dmp linux.check_idt.Check_idt #Checks if the IDT has been altered
./vol.py -f file.dmp linux.check_syscall.Check_syscall #Check system call table for hooks
./vol.py -f file.dmp linux.check_modules.Check_modules #Compares module list to sysfs info, if available
./vol.py -f file.dmp linux.tty_check.tty_check #Checks tty devices for hooks
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 -f file.dmp malfind [-D /tmp] #Find hidden and injected code [dump each suspicious section]
volatility --profile=Win7SP1x86_23418 -f file.dmp apihooks #Detect API hooks in process and kernel memory
volatility --profile=Win7SP1x86_23418 -f file.dmp driverirp #Driver IRP hook detection
volatility --profile=Win7SP1x86_23418 -f file.dmp ssdt #Check system call address from unexpected addresses

volatility --profile=SomeLinux -f file.dmp linux_check_afinfo
volatility --profile=SomeLinux -f file.dmp linux_check_creds
volatility --profile=SomeLinux -f file.dmp linux_check_fop
volatility --profile=SomeLinux -f file.dmp linux_check_idt
volatility --profile=SomeLinux -f file.dmp linux_check_syscall
volatility --profile=SomeLinux -f file.dmp linux_check_modules
volatility --profile=SomeLinux -f file.dmp linux_check_tty
volatility --profile=SomeLinux -f file.dmp linux_keyboard_notifiers #Keyloggers
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="scanning-with-yara"><a class="header" href="#scanning-with-yara">Scanning with yara</a></h3>
<p>Use this script to download and merge all the yara malware rules from github: <a href="https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9">https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9</a><br />
Create the <em><strong>rules</strong></em> directory and execute it. This will create a file called <em><strong>malware_rules.yar</strong></em> which contains all the yara rules for malware.</p>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">wget https://gist.githubusercontent.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9/raw/4ec711d37f1b428b63bed1f786b26a0654aa2f31/malware_yara_rules.py
mkdir rules
python malware_yara_rules.py
#Only Windows
./vol.py -f file.dmp windows.vadyarascan.VadYaraScan --yara-file /tmp/malware_rules.yar
#All
./vol.py -f file.dmp yarascan.YaraScan --yara-file /tmp/malware_rules.yar
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">wget https://gist.githubusercontent.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9/raw/4ec711d37f1b428b63bed1f786b26a0654aa2f31/malware_yara_rules.py
mkdir rules
python malware_yara_rules.py
volatility --profile=Win7SP1x86_23418 yarascan -y malware_rules.yar -f ch2.dmp | grep "Rule:" | grep -v "Str_Win32" | sort | uniq
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h2 id="misc"><a class="header" href="#misc">MISC</a></h2>
<h3 id="external-plugins"><a class="header" href="#external-plugins">External plugins</a></h3>
<p>If you want to use external plugins make sure that the folders related to the plugins are the first parameter used.</p>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py --plugin-dirs "/tmp/plugins/" [...]
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash"> volatilitye --plugins="/tmp/plugins/" [...]
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h4 id="autoruns"><a class="header" href="#autoruns">Autoruns</a></h4>
<p>Download it from <a href="https://github.com/tomchop/volatility-autoruns">https://github.com/tomchop/volatility-autoruns</a></p>
<pre><code> volatility --plugins=volatility-autoruns/ --profile=WinXPSP2x86 -f file.dmp autoruns
</code></pre>
<h3 id="mutexes"><a class="header" href="#mutexes">Mutexes</a></h3>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code>./vol.py -f file.dmp windows.mutantscan.MutantScan
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 mutantscan -f file.dmp
volatility --profile=Win7SP1x86_23418 -f file.dmp handles -p &lt;PID&gt; -t mutant
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="symlinks"><a class="header" href="#symlinks">Symlinks</a></h3>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py -f file.dmp windows.symlinkscan.SymlinkScan
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 -f file.dmp symlinkscan
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="bash"><a class="header" href="#bash">Bash</a></h3>
<p>It's possible to <strong>read from memory the bash history.</strong> You could also dump the <em>.bash_history</em> file, but it was disabled you will be glad you can use this volatility module</p>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code>./vol.py -f file.dmp linux.bash.Bash
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code>volatility --profile=Win7SP1x86_23418 -f file.dmp linux_bash
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="timeline"><a class="header" href="#timeline">TimeLine</a></h3>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code class="language-bash">./vol.py -f file.dmp timeLiner.TimeLiner
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code>volatility --profile=Win7SP1x86_23418 -f timeliner
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="drivers"><a class="header" href="#drivers">Drivers</a></h3>
<p>{{#tabs}}
{{#tab name="vol3"}}</p>
<pre><code>./vol.py -f file.dmp windows.driverscan.DriverScan
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="vol2"}}</p>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 -f file.dmp driverscan
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="get-clipboard"><a class="header" href="#get-clipboard">Get clipboard</a></h3>
<pre><code class="language-bash">#Just vol2
volatility --profile=Win7SP1x86_23418 clipboard -f file.dmp
</code></pre>
<h3 id="get-ie-history"><a class="header" href="#get-ie-history">Get IE history</a></h3>
<pre><code class="language-bash">#Just vol2
volatility --profile=Win7SP1x86_23418 iehistory -f file.dmp
</code></pre>
<h3 id="get-notepad-text"><a class="header" href="#get-notepad-text">Get notepad text</a></h3>
<pre><code class="language-bash">#Just vol2
volatility --profile=Win7SP1x86_23418 notepad -f file.dmp
</code></pre>
<h3 id="screenshot"><a class="header" href="#screenshot">Screenshot</a></h3>
<pre><code class="language-bash">#Just vol2
volatility --profile=Win7SP1x86_23418 screenshot -f file.dmp
</code></pre>
<h3 id="master-boot-record-mbr"><a class="header" href="#master-boot-record-mbr">Master Boot Record (MBR)</a></h3>
<pre><code class="language-bash">volatility --profile=Win7SP1x86_23418 mbrparser -f file.dmp
</code></pre>
<p>The <strong>Master Boot Record (MBR)</strong> plays a crucial role in managing the logical partitions of a storage medium, which are structured with different <a href="https://en.wikipedia.org/wiki/File_system">file systems</a>. It not only holds partition layout information but also contains executable code acting as a boot loader. This boot loader either directly initiates the OS's second-stage loading process (see <a href="https://en.wikipedia.org/wiki/Second-stage_boot_loader">second-stage boot loader</a>) or works in harmony with the <a href="https://en.wikipedia.org/wiki/Volume_boot_record">volume boot record</a> (VBR) of each partition. For in-depth knowledge, refer to the <a href="https://en.wikipedia.org/wiki/Master_boot_record">MBR Wikipedia page</a>.</p>
<h2 id="references"><a class="header" href="#references">References</a></h2>
<ul>
<li><a href="https://andreafortuna.org/2017/06/25/volatility-my-own-cheatsheet-part-1-image-identification/">https://andreafortuna.org/2017/06/25/volatility-my-own-cheatsheet-part-1-image-identification/</a></li>
<li><a href="https://scudette.blogspot.com/2012/11/finding-kernel-debugger-block.html">https://scudette.blogspot.com/2012/11/finding-kernel-debugger-block.html</a></li>
<li><a href="https://or10nlabs.tech/cgi-sys/suspendedpage.cgi">https://or10nlabs.tech/cgi-sys/suspendedpage.cgi</a></li>
<li><a href="https://www.aldeid.com/wiki/Windows-userassist-keys">https://www.aldeid.com/wiki/Windows-userassist-keys</a> ​* <a href="https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table">https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table</a></li>
<li><a href="https://answers.microsoft.com/en-us/windows/forum/all/uefi-based-pc-protective-mbr-what-is-it/0fc7b558-d8d4-4a7d-bae2-395455bb19aa">https://answers.microsoft.com/en-us/windows/forum/all/uefi-based-pc-protective-mbr-what-is-it/0fc7b558-d8d4-4a7d-bae2-395455bb19aa</a></li>
</ul>
<blockquote>
<p>[!TIP]
Learn &amp; practice AWS Hacking:<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><a href="https://training.hacktricks.xyz/courses/arte"><strong>HackTricks Training AWS Red Team Expert (ARTE)</strong></a><img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><br />
Learn &amp; practice GCP Hacking: <img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><a href="https://training.hacktricks.xyz/courses/grte"><strong>HackTricks Training GCP Red Team Expert (GRTE)</strong></a><img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"></p>
<details>
<summary>Support HackTricks</summary>
<ul>
<li>Check the <a href="https://github.com/sponsors/carlospolop"><strong>subscription plans</strong></a>!</li>
<li><strong>Join the</strong> 💬 <a href="https://discord.gg/hRep4RUj7f"><strong>Discord group</strong></a> or the <a href="https://t.me/peass"><strong>telegram group</strong></a> or <strong>follow</strong> us on <strong>Twitter</strong> 🐦 <a href="https://twitter.com/hacktricks_live"><strong>@hacktricks_live</strong></a><strong>.</strong></li>
<li><strong>Share hacking tricks by submitting PRs to the</strong> <a href="https://github.com/carlospolop/hacktricks"><strong>HackTricks</strong></a> and <a href="https://github.com/carlospolop/hacktricks-cloud"><strong>HackTricks Cloud</strong></a> github repos.</li>
</ul>
</details>
</blockquote>

                        </main>

                        <nav class="nav-wrapper" aria-label="Page navigation">
                            <!-- Mobile navigation buttons -->
                                <a rel="prev" href="../../../generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/index.html" class="mobile-nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
                                    <i class="fa fa-angle-left"></i>
                                </a>

                                <a rel="next prefetch" href="../../../generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html" class="mobile-nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
                                    <i class="fa fa-angle-right"></i>
                                </a>

                            <div style="clear: both"></div>
                        </nav>

                        <nav class="nav-wide-wrapper" aria-label="Page navigation">
                                <a rel="prev" href="../../../generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/index.html" class="nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
                                    <i class="fa fa-angle-left"></i><span style="font-size: medium; align-self: center; margin-left: 10px;">Memory dump analysis</span>
                                </a>

                                <a rel="next prefetch" href="../../../generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html" class="nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
                                    <span style="font-size: medium; align-self: center; margin-right: 10px;">Partitions/File Systems/Carving</span><i class="fa fa-angle-right"></i>
                                </a>
                        </nav>
                    </div>

                    <div class="sidetoc">
                        <div class="sidetoc-wrapper">
                            <nav class="pagetoc"></nav>
                            <a class="sidesponsor" href="" target="_blank">
                                <img src="" alt="" srcset="">
                                <div class="sponsor-title">
                                </div>
                                <div class="sponsor-description">
                                </div>
                                <div class="sponsor-cta"></div>
                            </a>
                        </div>
                    </div>
                </div>
                <div class="footer">
                    <div id="theme-wrapper" class="theme-wrapper">
                        <div id="theme-btns" class="theme-btns">
                            <button id="hacktricks-light" type="button" role="radio" aria-label="Switch to light theme" aria-checked="false" class="theme">
                                <i class="fa fa-sun-o"></i>
                            </button>
                            <button id="hacktricks-dark" type="button" role="radio" aria-label="Switch to dark theme" aria-checked="false" class="theme theme-selected">
                                <i class="fa fa-moon-o"></i>
                            </button>
                        </div>
                    </div>
                </div>
            </div>



        </div>




        <script>
            window.playground_copyable = true;
        </script>


        <script src="../../../elasticlunr.min.js"></script>
        <script src="../../../mark.min.js"></script>
        <!--<script src="../../../searcher.js"></script>-->

        <script src="../../../clipboard.min.js"></script>
        <script src="../../../highlight.js"></script>
        <script src="../../../book.js"></script>

        <!-- Custom JS scripts -->
        <script src="../../../theme/pagetoc.js"></script>
        <script src="../../../theme/tabs.js"></script>
        <script src="../../../theme/ht_searcher.js"></script>
        <script src="../../../theme/sponsor.js"></script>

        <!-- Custom analytics -->
        <script defer src="https://www.fairanalytics.de/pixel/deXeO7BNBrMuhdG1"></script>



    </div>
    </body>
</html>
