VOLATILITY 3 FORENSIC ANALYSIS COMMANDS

The acquired Windows memory images were analysed using Volatility 3
within the SIFT Workstation forensic environment.

Principal Volatility 3 plugins used:
- windows.pslist
- windows.pstree
- windows.cmdline
- windows.malfind


REPRESENTATIVE T3 POST ANALYSIS

vol -f /mnt/t3share/WIN10_T3_POST.raw windows.pslist

vol -f /mnt/t3share/WIN10_T3_POST.raw windows.pstree

vol -f /mnt/t3share/WIN10_T3_POST.raw windows.cmdline

vol -f /mnt/t3share/WIN10_T3_POST.raw windows.malfind


OUTPUT REDIRECTION

vol -f /mnt/t3share/WIN10_T3_POST.raw windows.pslist > ~/cases/T3/evidence/T3_POST_pslist.txt

vol -f /mnt/t3share/WIN10_T3_POST.raw windows.pstree > ~/cases/T3/evidence/T3_POST_pstree.txt

vol -f /mnt/t3share/WIN10_T3_POST.raw windows.cmdline > ~/cases/T3/evidence/T3_POST_cmdline.txt

vol -f /mnt/t3share/WIN10_T3_POST.raw windows.malfind > ~/cases/T3/evidence/T3_POST_malfind.txt


TARGETED EVIDENCE FILTERING

grep -Ei "powershell|winpmem|cmd.exe" ~/cases/T3/evidence/T3_POST_pslist.txt

grep -Ei "powershell|winpmem|cmd.exe" ~/cases/T3/evidence/T3_POST_pstree.txt

grep -Ei "powershell|winpmem|T1_Simulator|locked" ~/cases/T3/evidence/T3_POST_cmdline.txt

grep -i -A 15 -B 2 "powershell" ~/cases/T3/evidence/T3_POST_malfind.txt
