The Real Hugo
Husk

Volatility

volatility -f <file.iso> imageinfo
volatility -f <file.iso> kdbgscan
  • Process list
volatility -f <file.iso> --profile <OSprofile> pslist
  • List dlls
volatility -f <file.iso> --profile <OSprofile> dlllist -p <PID>
  • Last accessed dir
volatility -f <file.iso> --profile <OSprofile> shellbags

Plugins

  • For example
    • Truecryptpassphrase
    • cmdscan, command history
    • shutdowntime