CmdID

CmdID / Commands

vol.py

Forensics framework used to analyze volatile memory (RAM) dumps. tldr-pages

On Windows

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from tldr-pages, CC BY 4.0

Forensics framework used to analyze volatile memory (RAM) dumps. With volatility3, plugins are now based on operating system. Examples below will use Windows.

Get information about a memory dump file

python3 vol.py --filename path\to\memory_dump_file windows.infoIdentify

List active processes

python3 vol.py --filename path\to\memory_dump_file windows.pslistIdentify

List hashes of users on system

python3 vol.py --filename path\to\memory_dump_file windows.hashdumpIdentify

List active network connections

python3 vol.py --filename path\to\memory_dump_file windows.netstatIdentify

Display help

python3 vol.py --helpIdentify