Hey everyone welcome to the introduction to volatility.
Previously we introduced the basic concepts of virtual memory and memory forensics.
In this video we're going to introduce the volatility framework and its various plug ins profiles and
options.
Volatility is the most popular open source memory analysis framework which is written in Python and
it supports Windows Linux Mac and Android memory images for the moment.
The latest version is 2.6 and it's installed by default on Kalli Linux.
Volatility includes several plug ins to extract different artifacts from memory images and new functionalities
can be implemented through it's extensible and scriptable application programming interface or API.
It can analyze memory images of various formats and also hibernation and crashed on files.
Volatility is not a memory acquisition tool and it does not provide a graphical front end to begin.
Let's take a look at Bhola Tillie's options with the command.
Volatility allows to use a custom configuration file with the compile option and to specify directories
that contain additional plugins to use with the plugins option.
The info option as we're going to see shortly displays the available plugins and profiles the dash F
or file name option allows to specify the input memory image to analyze.
It's a mandatory option.
While the profile option is the profile to use a profile tells volatility the OS type and version of
the memory image so it can be analyzed with the appropriate plugins.
If the profile is not specify with this option the default when XP Espey to X 86 profile is used.
If we run volatility with the info option we could see the full list of the available profiles and plugins.
We notice that there are profiles for each version of Windows XP XP one and so on Linux a Mac profiles
are not enabled by default.
If we want them enabled we can download the designer profiles at this link.
For example we download the profile free buntu we click on the Linux folder then Ubuntu 64 bit and then
download the buntu 64 profile we download the zip file and we save it to the directory under the path
user lib Python 2.7 dist packages volatility plugins overlays and then the Linux directory we download
the profiles it file then go back to the shell run volatility info again.
We notice that this new profile has been added at the top of the profile list.
It's not recommended to add many profiles as it would slow the program loading but instead only those
we need from time to time.
The info option also shows all the available plugins each plugin is used to extract a different type
of artifact from the memory image artifact.
Info about running processes and deals loaded kernel modules and drivers cached HIV's event logs network
connections and malware signatures.
If we don't know what type of system a memory image has been captured from the image info plug and can
help us for more information about volatility usage and options refer to the wiki page at this link.
In this video we introduce the volatility memory analysis framework and its options profiles and plugins
in the next video we're going to cover.
The analysis of a memory image with volatility.