One of the key preliminary steps that must be completed prior to conducting a detailed examination of the system memory is to determine the exact OS of the system under investigation. Even if the analyst is certain of the OS, it is still a good practice to run the memory images against Volatility's imageinfo plugin. The output of this plugin identifies the potential profile of the memory image that becomes critical to utilizing the other plugins available.
To determine the profile of the memory image, type the following into the command line:
forensics@ubuntu:~/Documents$ volatility -f stuxnet.vmemimageinfo
This produces the following output:
From this output, the analyst is provided with a good deal of information. ...
