Difference between pages "List of Volatility Plugins" and "User:PashaPal"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
(Data Recovery)
 
(Created page with 'Anandabrata (Pasha) Pal is a researcher conducting work in File Carving. He is a founding member of Digital Assembly that produces recovery and forensic products. Pasha has…')
 
Line 1: Line 1:
The [[Volatility Framework]] was designed to be expanded by plugins. Here is a list of the published plugins for the framework. Note that these plugins are not hosted on the wiki, but all on external sites.
+
Anandabrata (Pasha) Pal is a researcher conducting work in [[File Carving]].  
 +
He is a founding member of Digital Assembly that produces recovery and
 +
forensic products.
  
== Command Shell ==
+
Pasha has co-authored 4 articles on file carving, one of which won the best
* [http://moyix.blogspot.com/2008/08/indroducing-volshell.html volshell] - Creates a python shell can be used with the framework.
+
paper award at DFRWS 2008. His research is the basis for the recovery and
 
+
forensics products developed at Digital Assembly. Accees to his published
== Malware Detection ==
+
papers are available at: http://digital-assembly.com/technology/
* [http://mnin.blogspot.com/2009/01/malfind-volatility-plug-in.html malfind] (By [http://mnin.blogspot.com/2009/01/malfind-volatility-plug-in.html Michael Hale Ligh]) - Automates the process of finding and extracting (usually malicious) code injected into another process
+
 
+
== Data Recovery ==
+
 
+
* [http://jessekornblum.com/tools/volatility/cryptoscan.py cryptoscan] (By [http://jessekornblum.livejournal.com/246616.html Jesse Kornblum]) - Finds [[TrueCrypt]] passphrases
+
* [http://moyix.blogspot.com/2008/10/plugin-post-moddump.html moddump] (By [[http://moyix.blogspot.com/2008/10/plugin-post-moddump.html Moyix]) - Dump out a kernel module (aka driver)
+
* [http://moyix.blogspot.com/2009/01/memory-registry-tools.html Registry tools] (By [http://moyix.blogspot.com/2009/03/regripper-and-volatility-prototype.html Moyix]) - A suite of plugins for accessing data from the registry, including password hashes, LSA secrets, and arbitrary registry keys.
+
* [http://www.cc.gatech.edu/%7Ebrendan/volatility/dl/volrip-0.1.tar.gz Modified Regripper & Glue Code] (By [http://moyix.blogspot.com/2009/03/regripper-and-volatility-prototype.html Moyix]) - Code to run a modified RegRipper against the registry hives embedded in a memory dump. Note that due to a dependency on Inline::Python, this only works on Linux.
+
* [http://moyix.blogspot.com/2008/08/linking-processes-to-users.html getsids] (By [http://moyix.blogspot.com/2008/08/linking-processes-to-users.html Moyix]) - Get information about what user (SID) started a process.
+
* [http://moyix.blogspot.com/2008/08/auditing-system-call-table.html ssdt] (By [http://moyix.blogspot.com/2008/08/auditing-system-call-table.html Moyix]) - List entries in the system call table. Can be used to detect certain rootkits that hook system calls by replacing entries in this table.
+
* [http://moyix.blogspot.com/2008/09/window-messages-as-forensic-resource.html threadqueues] (By [http://moyix.blogspot.com/2008/09/window-messages-as-forensic-resource.html Moyix]) - Enumerates window messages pending for each thread on the system. Window messages are the mechanism used to send things like button presses, mouse clicks, and other events to GUI programs.
+
* [http://computer.forensikblog.de/files/volatility_plugins/volatility_objtypescan-current.zip objtypescan] (By [http://computer.forensikblog.de/en/2009/04/scanning_for_file_objects.html Andreas Schuster]) - Lists open files by enumerating the _FILE_OBJECT structure. (Note: If running the SVN version of Volatility, just install the plugin file from this archive)
+
* [http://computer.forensikblog.de/files/volatility_plugins/keyboardbuffer.py keyboardbuffer] (By [http://computer.forensikblog.de/en/2009/04/read_password_from_keyboard_buffer.html#more Andreas Schuster]) - Extracts keyboard buffer used by the BIOS, which may contain BIOS or disk encryption passwords.
+
* [http://computer.forensikblog.de/files/volatility_plugins/volatility_mutantscan-current.zip mutantscan] (By [http://computer.forensikblog.de/en/2009/04/searching_for_mutants.html#more Andreas Schuster]) - Extracts mutexs from the Windows kernel.(Note: If running the SVN version of Volatility, just install the plugin file from this archive.)
+
* [http://computer.forensikblog.de/files/volatility_plugins/volatility_symlinkobjscan-current.zip symlinkobjscan] (By [http://computer.forensikblog.de/en/2009/04/symbolic_link_objects.html#more Andreas Schuster]) - Extracts symbolic link objects from the Windows kernel.(Note: If running the SVN version of Volatility, just install the plugin file from this archive.)
+
* [http://computer.forensikblog.de/files/volatility_plugins/volatility_driverscan-current.zip driverscan] (By [http://computer.forensikblog.de/en/2009/04/scanning_for_drivers.html#more Andreas Schuster]) - Scan for kernel _DRIVER_OBJECTs. (Note: If running the SVN version of Volatility, just install the plugin file from this archive.)
+
* [http://computer.forensikblog.de/files/volatility_plugins/volatility_fileobjscan-current.zip fileobjscan] (By [http://computer.forensikblog.de/en/2009/04/linking_file_objects_to_processes.html#more Andreas Schuster]) - File object -> process linkage, including hidden files. (Note: If running the SVN version of Volatility, just install the plugin file from this archive.)
+
 
+
== Process Enumeration ==
+
 
+
* [http://jessekornblum.com/tools/volatility/suspicious.py suspicious] (By [http://jessekornblum.livejournal.com/246616.html Jesse Kornblum]) - Identify "suspicious" processes. This version counts any command line running [[TrueCrypt]] or any command line that starts with a lower case drive letter as suspicious.
+
 
+
== Output Formatting ==
+
 
+
* [http://scudette.blogspot.com/2008/10/pstree-volatility-plugin.html pstree] - Produces a tree-style listing of processes
+
* [http://gleeda.blogspot.com/2009/03/briefly-vol2html-update.html vol2html] - Converts volatility output to HTML. Not technically a plugin, but useful nonetheless.
+

Revision as of 06:16, 22 October 2009

Anandabrata (Pasha) Pal is a researcher conducting work in File Carving. He is a founding member of Digital Assembly that produces recovery and forensic products.

Pasha has co-authored 4 articles on file carving, one of which won the best paper award at DFRWS 2008. His research is the basis for the recovery and forensics products developed at Digital Assembly. Accees to his published papers are available at: http://digital-assembly.com/technology/