Digital Forensics and Incident Response - Second Edition

Volatility image information

One of the key preliminary steps that must be completed prior to conducting a detailed examination of the system memory is to determine the exact OS of the system under investigation. Even if the analyst is certain of the OS, it is still a good practice to run the memory images against Volatility's imageinfo plugin. The output of this plugin identifies the potential profile of the memory image that becomes critical to utilizing the other plugins available. The following command is used:

dfir@Desktop-SFARF6G~$ volatility -f cridex_laptop.mem imageinfo

Volatility will output the following, which indicates that the profile most likely to produce the best results is WinXPSP2x86:

Next, let's look at Volatility process ...