Difference between revisions of "Volatility Framework"
Joachim Metz (Talk | contribs) |
Joachim Metz (Talk | contribs) (→Windows) |
||
| (8 intermediate revisions by one user not shown) | |||
| Line 3: | Line 3: | ||
maintainer = [[AAron Walters]] | | maintainer = [[AAron Walters]] | | ||
os = {{Cross-platform}} | | os = {{Cross-platform}} | | ||
| − | genre = {{Memory analysis}} | | + | genre = {{Memory analysis}}, {{Memory imaging}} | |
license = {{GPL}} | | license = {{GPL}} | | ||
website = [https://www.volatilesystems.com/default/volatility https://www.volatilesystems.com/] | | website = [https://www.volatilesystems.com/default/volatility https://www.volatilesystems.com/] | | ||
| Line 26: | Line 26: | ||
In the scudette branch the drivers can be found under: | In the scudette branch the drivers can be found under: | ||
<pre> | <pre> | ||
| − | volatility/tools/linux | + | volatility/tools/linux |
| + | volatility/tools/windows | ||
</pre> | </pre> | ||
| Line 68: | Line 69: | ||
volatility/tools/linux/README | volatility/tools/linux/README | ||
</pre> | </pre> | ||
| + | |||
| + | === Mac OS X === | ||
| + | |||
| + | A Mac OS X driver is currently being worked on. | ||
=== Windows === | === Windows === | ||
| − | Since recent versions of | + | Since recent versions of Windows require a signed driver, the volatility scudette branch comes with both pre-built (signed binary) and source versions of the driver. |
| − | Both the i386 and amd64 binary version of the driver can be found on the [http://code.google.com/p/volatility/downloads/list downloads] part of the Volatility code repository as winpmem or in the scudette branch under: | + | Both the i386 and amd64 binary version of the driver can be found on the [http://code.google.com/p/volatility/downloads/list downloads] part of the Volatility code repository as a package named '''winpmem''' or in the scudette branch under: |
<pre> | <pre> | ||
volatility/tools/winpmem/binaries/ | volatility/tools/winpmem/binaries/ | ||
| Line 96: | Line 101: | ||
\\.\pmem | \\.\pmem | ||
</pre> | </pre> | ||
| + | |||
| + | Note that running dd directly on this device file can crash the machine. | ||
| + | Use the winpmem.exe tool instead because it handles protected memory regions. | ||
To read and acquire the physical memory and write it to image.raw: | To read and acquire the physical memory and write it to image.raw: | ||
| Line 117: | Line 125: | ||
== External Links == | == External Links == | ||
* [https://www.volatilesystems.com/default/volatility Official web site] | * [https://www.volatilesystems.com/default/volatility Official web site] | ||
| − | * [http://code.google.com/p/volatility/ Code repository], | + | * [http://code.google.com/p/volatility/ Code repository], direct link to [http://code.google.com/p/volatility/source/browse/ source] |
* [http://code.google.com/p/volatility/w/list Volatility Documentation] | * [http://code.google.com/p/volatility/w/list Volatility Documentation] | ||
Latest revision as of 14:16, 31 July 2012
| Volatility | |
|---|---|
| Maintainer: | AAron Walters |
| OS: | Cross-platform |
| Genre: | Memory Analysis,Memory Imaging |
| License: | GPL |
| Website: | https://www.volatilesystems.com/ |
The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.
The project was originally developed by and is now headed up by AAron Walters of Volatile Systems.
Contents |
[edit] Plugins
See: List of Volatility Plugins
[edit] Memory acquisition drivers
In 2012 Michael Cohen contributed both a Linux and a Windows Open Source memory (acquisition) driver to the volatility project.
These drivers are currently available in the volatility scudette branch and soon to be released as a separate download. To obtain this branch run:
svn checkout http://volatility.googlecode.com/svn/branches/scudette/ volatility
In the scudette branch the drivers can be found under:
volatility/tools/linux volatility/tools/windows
[edit] Linux
To build the kernel module for the current kernel version, make sure you have a working build environment and the kernel headers installed. Change into this directory and run make:
cd volatility/tools/linux/ make
The acquisition driver is named pmem.ko.
To load the driver:
sudo insmod pmem.ko
To check if the driver is running:
sudo lsmod
The driver create a device file named:
/dev/pmem
To unload the driver:
sudo rmmod pmem
To read acquire the memory just read from the device file. e.g.
dd if=/dev/pmem of=image.raw
For more information see:
volatility/tools/linux/README
[edit] Mac OS X
A Mac OS X driver is currently being worked on.
[edit] Windows
Since recent versions of Windows require a signed driver, the volatility scudette branch comes with both pre-built (signed binary) and source versions of the driver.
Both the i386 and amd64 binary version of the driver can be found on the downloads part of the Volatility code repository as a package named winpmem or in the scudette branch under:
volatility/tools/winpmem/binaries/
E.g.
volatility/tools/winpmem/binaries/amd64/winpmem.sys
A standalone tool for imaging memory that uses an embedded copy of the pmem driver can be found as winpmem.exe in:
volatility/tools/winpmem/executables/Release/
To load the driver:
winpmem.exe -l
The device filename is (This can not be changed without recompiling):
\\.\pmem
Note that running dd directly on this device file can crash the machine. Use the winpmem.exe tool instead because it handles protected memory regions.
To read and acquire the physical memory and write it to image.raw:
winpmem.exe image.raw
To unload the driver:
winpmem.exe -u
For more information see:
volatility/tools/windows/README
[edit] See Also
[edit] External Links
- Official web site
- Code repository, direct link to source
- Volatility Documentation
