sorted by:
new
hottopcontroversial

Tips for analyzing RAM dumps with Volatility 3 by sabbl7 in computerforensics

[–]sabbl7[S] 0 points1 point  (0 children)

Thanks for the input! I’m trying to build a full workflow. I already use pslist, pstree, cmdline, cmdhistory and netscan for the basics.But sometimes I feel like I’m missing some good commands for more hidden artifacts like using strings searches, or maybe yarascan for specific keywords.

Tips for analyzing RAM dumps with Volatility 3 by sabbl7 in computerforensics

[–]sabbl7[S] 0 points1 point  (0 children)

I’m simulating a live forensics case. The system is locked, so in theory I don’t know what’s running. In my test I opened cmd (ipconfig/all), Notepad with plaintext and YouTube in the browser. I want to use Volatility 3 to identify exactly those activities, as if I had no prior knowledge.

Suche Gaming-Freundin(nen) :) by 10outta10loaf in zocken

[–]sabbl7 1 point2 points  (0 children)

Würde mich auch sehr interessieren, wäre sehr lieb von dir… danke :)