Cheat sheet
Volatility 3
The essential plugins to analyse a Windows memory image. The full approach is in Forensics (DFIR).
CDSAForensics
Syntax
# General form vol -f memory.raw <plugin> [options] # Example: process tree vol -f memory.raw windows.pstree # CSV output for Timeline Explorer or a spreadsheet vol -f memory.raw -r csv windows.pslist > pslist.csv
Volatility 2 or 3?Version 3 detects the system automatically: no more --profile option as in version 2. Plugins are prefixed by the OS: windows., linux., mac.
Windows plugins
| Plugin | Use |
|---|---|
| windows.info | System version and image information |
| windows.pslist | Active processes (kernel linked list) |
| windows.psscan | Processes found by scanning, including hidden or terminated ones |
| windows.pstree | Parent / child process tree |
| windows.cmdline | Command line of each process |
| windows.dlllist | DLLs loaded by each process |
| windows.handles | Open handles (files, keys, mutexes…) |
| windows.netscan | Network connections and ports |
| windows.malfind | Suspicious executable memory regions (injected code) |
| windows.filescan | File objects present in memory |
| windows.dumpfiles | Extract files from memory |
| windows.registry.hivelist | Loaded registry hives |
| windows.registry.printkey | Read a registry key |
| windows.svcscan | Windows services |
| windows.hashdump | Local account hashes |
Suggested analysis order
- Identifywindows.info: which system, which capture date.
- Processespslist, psscan, pstree: compare, look for anomalies.
- Contextcmdline, dlllist: what is each suspicious process doing?
- Networknetscan: who is it talking to?
- Injectionmalfind: was code injected?
- Extractdumpfiles, then hash and analyse the sample.
Red flagsA process present in psscan but missing from pslist (hidden), an almost-correct name (scvhost.exe), an svchost.exe whose parent is not services.exe, a system process launched from an unusual folder.