The volatility framework is an open source, cross-platform incident response framework that comes with
many useful plugins that provide the investigator with a wealth of information from a snapshot of a
memory also known as Memory Dump.
The concept of volatility has been around for a decade, and apart from analyzing, running and hidden
processes, it's also very popular choice for a malware analysis.
So to create a memory dump, you need a several tools that we did in previous lectures like a Well-conserved
ramp capture, FTK imager, DDC, 3D, sane computer aided Investigate Environment, Helix and Linux
Memory Extractor named as Lime.
So these tools can be used to acquire the memory, image or memory dump and then be investigated and
analyzed by the tools within a volatility framework.
And so volatility framework can be run on any operating system, both 32 bit or 64 bit.
So the and the any operating system that supports Python, so including the Windows XP seven eight,
8.1 and Windows 10 11 Windows servers Linux like almost all Linux starting from 2.6. 11 and like newer
Linux here you it you can also run the volatility framework in Mac OS.
So volatility supports several dumps dump formats both 32 bit and 64 bit, including the Windows crash
and hibernation dumps.
For the Windows 7 and earlier.
It also supports the VMware that VM dumps.
It also supports the virtual box dump.
VirtualBox dumps VirtualBox core dumps.
It also supports the VMware saved State.
The named that VM, SS and vm sn here.
It also supports the raw physical memory.
Memory.
Name.
It also supports the QEMU.
This means this actually means the quick emulator qemu.
Firewall.
H pack.
And like direct physical memory dump over in 1394 FireWire wire here.
So volatility even allows for a conversion between these formats and both of being able to accomplish
everything similar tools can.
So you can download the volatility from the internet, from GitHub, its official GitHub here.
Let's open here.
Okay, so volatility GitHub.
Here bottle the foundation volatility.
So.
Here.
So there is the memory samples that you can use here.
Memory samples.
Okay.
And you can also download the volatility distribution from the, uh, official website, the downloads.
Here, click on downloads.
Yeah.
You can also download volatility tree or volatility to.
In this case.
Here.
As you can see, there's a older versions beyond XP, Linux, Mac OS X, and in this case, we're going
to use the windows.
In this case, we're going to use the volatility 2.6.
As you can see, you can also download for Mac OS Linux.
You can also download source code if you want to compile it again.
And you can also download the windows here.
So in this case, I'm going to I'm not going to download it, but it's actually the same procedure.
And in this case I'm going to use use a apt package manager to install volatility from the terminal.
So here.
Here.
We also have the.
Memory samples, which we're going to work on it here.
This is the memory samples and we will download one by one and work and analyze it and learn volatility
more deeply.
So let's now download the volatility.
So in some most Linux distributions, like if I would have CSI Linux or SANE operating system, then
I would like volatility would come pre-installed here, but in Linux it doesn't come pre-installed,
so we have to install it.