272 Cyber seCurity essentiAls
thrdscan2 Scan for thread objects (New)
vaddump Dump the Vad sections to files
vadinfo Dump the VAD info
vadwalk Walk the vad tree
All of the commands shown in the output are available by default.
Analysts can learn any required arguments for individual commands
by issuing “python volatility <command> --help”; however, many of
the commands work without arguments. e full syntax for extract-
ing evidence from the memory dump created with Volatility follows:
$ python volatility <command> <arguments> -f mem.dmp
5.1.6 Finding Hidden Processes
e Windows kernel creates an EPROCESS object for every process
on the system. e object contains a pair of pointers, which identifies
the previous and subsequent process ...