Memory dump analysis using Volatility 3

For those of you who may have read previous editions of this book where we used Volatility 2, or are just familiar with using Volatility 2, you will notice that Volatility 3 is a bit different as far as the plugins are concerned. You may also notice that the speed at which the plugins work is also faster in Volatility 3.

For this lab, we’ll take a very structured approach using the various plugins in Volatility 3. We’ll first look at process and service identification, gather some user information, have a look at registry information, and discover any malware that may be running on the device.

Using Volatility 3 is quite simple. Once you are in the Volatility directory, the commands to use the plugins are essentially the same apart from the plugin name.

The syntax is as follows:

python3 -f (dump name) (OS.plugin)

In the preceding example, -f specifies the filename of the dump, which in our case is cridex.vmem, and...