An Introduction to VolUtility, (Mon, Jun 12th)

If you would like to practicememory forensics using Volatility but you dont like command line tools and you hate to remmber plugins then VolUtility is your friend.

Volutility1is a web frontend for Volatility framework.


In this dairy, I will install VolUtlity on Linux SIFT2workstation.

  1. Update your SIFT workstation and install django margin-right:210.0pt">$ sudo apt-get update margin-right:0in">

    1. Install MongoDB :

    In this dairy I am not going to discuss how to install MongoDB , for futher details about margin-left:.5in">

    		</p><p>$ git clone</p>
    		<p>$ cd volatility</p>
    		<p>$ sudo python install</p>


    		</p><p>$ git clone</p>


    In this diary I am going to use the default config file volutility.conf.sample border:solid windowtext 1.0pt">

    		</p><p>$ ./ runserver</p>

    width:400px" />

    Enter a name for the session and the location of the memory image ,for the profile you can either specify it or you can choose autodetect, then click on submit button width:400px" />

    You have to wait for few minutest till it finishes from processing the image, once it finished the status will change to Complete width:400px" />

    To examine the image click on the session name , in this the dairy its SANS ISC width:400px" />

    Now let width:400px" />

    And you can of course filter your result using tools such as MS Excel.




    © SANS Internet Storm Center. Creative Commons Attribution-Noncommercial 3.0 United States License.

Article Link: