Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
The Volatility Framework
Here's another possible addition to your security toolkit. Volatility Framework is collection of Python-based tools that can extract artifacts from memory images.
ITPro Today
March 19, 2008
1 Min Read
collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) images.
Available as open source under GNU license, Volatility works on Linux, OS X, and Windows with Cygwin libraries and can analyze memory images captured from Windows XP Service Pack 2 systems.
The framework can extract data:
* Image date and time
* Running processes
* Open network sockets
* Open network connections
* DLLs loaded for each process
* Open files for each process
* OS kernel modules
* Mapping physical offsets to virtual addresses (strings to process)
* Virtual Address Descriptor information
* Scanning examples: processes, threads, sockets, connections
You can learn a lot more about the framework and download a copy at Volatile Systems' Web site.
About the Author
You May Also Like
.png?width=700&auto=webp&quality=80&disable=upscale)