Difference between pages "Carver 2.0 Planning Page" and "List of Volatility Plugins"
From Forensics Wiki
(Difference between pages)
(→Requirements) |
m (Fixing broken links) |
||
| Line 1: | Line 1: | ||
| − | + | The [[Volatility Framework]] was designed to be expanded by plugins. Here is a list of the published plugins for the framework. Note that these plugins are not hosted on the wiki, but all on external sites. | |
| − | = | + | == Command Shell == |
| + | * [http://moyix.blogspot.com/2008/08/indroducing-volshell.html volshell] - Creates a python shell can be used with the framework. | ||
| − | + | == Data Recovery == | |
| − | + | * [http://jessekornblum.com/tools/volatility/cryptoscan.py cryptoscan] - Finds [[TrueCrypt]] passphrases | |
| + | * [http://moyix.blogspot.com/2008/10/plugin-post-moddump.html moddump] - Dump out a kernel module (aka driver) | ||
| − | + | == Process Enumeration == | |
| − | + | * [http://jessekornblum.com/tools/volatility/suspicious.py suspicious] - Identify "suspicious" processes. This version counts any command line running [[TrueCrypt]] or any command line that starts with a lower case drive letter as suspicious. | |
| − | * | + | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | = | + | == Output Formatting == |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | * [http://scudette.blogspot.com/2008/10/pstree-volatility-plugin.html pstree] - Produces a tree-style listing of processes | |
| − | + | * [http://gleeda.blogspot.com/2009/01/vol2htmlpl-update.html vol2html] - Converts volatility output to HTML. Not technically a plugin, but useful nonetheless. | |
| − | + | ||
Revision as of 07:30, 16 January 2009
The Volatility Framework was designed to be expanded by plugins. Here is a list of the published plugins for the framework. Note that these plugins are not hosted on the wiki, but all on external sites.
Contents |
Command Shell
- volshell - Creates a python shell can be used with the framework.
Data Recovery
- cryptoscan - Finds TrueCrypt passphrases
- moddump - Dump out a kernel module (aka driver)
Process Enumeration
- suspicious - Identify "suspicious" processes. This version counts any command line running TrueCrypt or any command line that starts with a lower case drive letter as suspicious.
