Using Volatility in Kali Linux

To start the Volatility Framework, click on the All Applications button at the bottom of the sidebar and type volatility in the search bar:

Clicking on the volatility icon starts the program in a Terminal. When Volatility starts, we see that the version being used is 2.6 and also presents us with options for use:

For a complete list of all plugins at your fingertips, open a separate Terminal and run the volatility -h command, rather than having to scroll to the top of the Terminal that you are using to run Volatility plugin commands:

The following screenshot shows a snippet of some of the many plugins within the Volatility Framework:

This list comes in handy when performing analysis as each plugin comes with its own short description. The following screenshot shows a snippet of the help command, which gives a description of the imageinfo plugin:

The format for using plugins in Volatility is:

volatility -f [filename] [plugin] [options]

As seen in the previous section...