vola vola easy vola

vol.py -f /Scenarios/Investigations/Investigation-1.vmem  -o /home windows.memmap.Memmap --pid 1640 --dump

strings pid.1640.dmp | grep -i "user-agent"


vol -f /Scenarios/Investigations/Investigation-2.raw  windows.dlllist.DllList -p 740


1484 1464 explorer.exe0x821dea70174150False2012-07-22 02:42:36.000000 N
/ADisabled
1512 652 spoolsv.exe0x81eb17b8141130False2012-07-22 02:42:36.000000 N
/ADisabled
1640 1484 reader_sl.exe0x81e7bda05390False2012-07-22 02:42:36.000000 N
/ADisabled


thmanalyst@ubuntu:/home$ cd /opt
thmanalyst@ubuntu:/opt$ ls
volatility3
thmanalyst@ubuntu:/opt$ cd volatility3/
thmanalyst@ubuntu:/opt/volatility3$ ls
development  dump.raw   LICENSE.txt  mypy.ini   setup.py     vol.py       volshell.spec
doc          dump.vmem  MANIFEST.in  README.md  volatility3  volshell.py  vol.spec
thmanalyst@ubuntu:/opt/volatility3$ vol -f /Scenarios/Investigations/Investigation-1.vmem windows.info
Volatility 3 Framework 1.0.1
Progress:  100.00PDB scanning finished                     
VariableValue

Kernel Base0x804d7000
DTB0x2fe000
Symbolsfile:///opt/volatility3/volatility3/symbols/windows/ntkrnlpa.pdb/30B5FB31AE7E4ACAABA750AA241FF331-1.j
son.xz
Is64BitFalse
IsPAETrue
primary0 WindowsIntelPAE
memory_layer1 FileLayer
KdDebuggerDataBlock0x80545ae0
NTBuildLab2600.xpsp.080413-2111
CSDVersion3
KdVersionBlock0x80545ab8
Major/Minor15.2600
MachineType332
KeNumberProcessors1
SystemTime2012-07-22 02:45:08
NtSystemRootC:\WINDOWS
NtProductTypeNtProductWinNt