Memory Forensics and Analysis Using Volatility

Table of Contents

• Introduction
• Tools Used
• Approach to Problem
• Learning Outcomes
• References

Introduction

The premise of this project is to perform memory forensics and analysis using Volatility. The final report will be linked in the References section. This will be done through Linux as the SIFT Workstation already comes with Volatility pre-installed.

Tools Used

The tools used here are the following:

1. SIFT Workstation
2. FTK® Imager
3. Oracle VM VirtualBox
4. Windows 10 ISO

Approach to Problem

1. Solved the problem set with the commands that are offered within Volatility.
2. To create a dump file, I used FTK imager for memory collection.

Learning Outcomes

1. Learned how to use Volatility commandlets that can manipulate Image Identification, Processes Listings, Process Information, PE File Extraction, Code Injection, Logs/Histories, Network Information, Kernel Memory/Objects, Timelines, Volshell, Dump Conversion, API Hookings, YARA Scanning, File System Resources, GUI Memory, Disk Encryption, Password Recovery and Strings.
2. Learned how to use FTK imager for memory collection.

References

Written report linked here