The Volatility Framework is an open source collection of tools written in Python for the extraction of digital artifacts from memory images. This time, we will use the second memory image, obtained earlier with DumpIt, as a data source to show you how to use this tool set for memory forensics.
Windows memory image analysis with Volatility
Getting ready
The Volatility Framework is an open source toolkit, so it's cross-platform, which means that you can use any operating system family you want - Windows, Linux, or mac OS. Of course, you can build these tools from source, but there are also so-called standalone executables for all the operating systems mentioned. As this cookbook is about forensic examination of Windows...
