Using Volatility in Kali Linux
While still within the desktop directory, we can now install a stable version of Volatility and begin our forensic investigation and analysis of the memory dump (the vmem
file) and search for various artifacts.
To view the options within Volatility, type in volatility –h
. If Volatility does not start, or a command not found
error is returned, install the Volatility Framework by typing apt-get install volatility
. During the installation, you will be prompted to press Y
(yes) to download the files required for the installation:
Once the installation is complete, type volatility –h
to view the options within the Volatility Framework:
Important note
For easy reference and a complete list of all the plugins at your fingertips, open a separate terminal and run the volatility -h...