A CORPOLEARN SPECIALIST SCHOOL

Preparing a defensible security scenario

$ root@cyber-terminal:~/domains/dfir-forensics/digital-forensics-incident-response-dfir-memory-analysis-with-volatility#

|
|
[

1 MIN READ

]

Digital Forensics & Incident Response (DFIR): Memory Analysis with Volatility

Volatility 3 is the industry-standard open-source memory forensics framework used to analyze RAM captures during incident response investigations.

# Extract Process Tree from Windows RAM Image
$ python3 vol.py -f memory.raw windows.pstree

# Scan for Injected DLLs & Shellcode
$ python3 vol.py -f memory.raw windows.malfind