This commit is contained in:
Stefan Friese 2021-11-07 02:09:10 +01:00
parent 4e6a13857f
commit 39ae876150
4 changed files with 13 additions and 0 deletions

6
.gitmodules vendored
View File

@ -61,3 +61,9 @@
[submodule "hashes/wordlistctl"]
path = hashes/wordlistctl
url = https://github.com/BlackArch/wordlistctl.git
[submodule "forensics/volatility3"]
path = forensics/volatility3
url = https://github.com/volatilityfoundation/volatility3.git
[submodule "forensics/volatility"]
path = forensics/volatility
url = https://github.com/volatilityfoundation/volatility.git

1
forensics/volatility Submodule

@ -0,0 +1 @@
Subproject commit a438e768194a9e05eb4d9ee9338b881c0fa25937

1
forensics/volatility3 Submodule

@ -0,0 +1 @@
Subproject commit 23453f5d8c56030acf1fea72f2b9d0c9dfda85c6

View File

@ -27,6 +27,7 @@ vmonkey <file.doc>
* Basic Info, find OS profile
```sh
volatility -f <file.iso> imageinfo
volatility -f <file.iso> kdbgscan
```
* Process list
```sh
@ -36,4 +37,8 @@ volatility -f <file.iso> --profile <OSprofile> pslist
```sh
volatility -f <file.iso> --profile <OSprofile> dlllist -p <PID>
```
* Last accessed dir
```sh
volatility -f <file.iso> --profile <OSprofile> shellbags
```