Hello.
In this lecture we're going to download the volatility test images to use as the memory forensics or
other purposes.
So in order to download it, you're going to get you're going to visit the GitHub Volatility Foundation
official GitHub website.
And here with this link, I'm going to share this link with you in the lectures attachment section.
So you can click on this or you can just write it.
So it's a short link here.
So there is our test images provided by the public test images, test image samples for testing purposes.
So here we have a mac OS here, Windows XP 86 and the 2003 SP zero service pack zero and we have Cridex
malware, Shylock malware, R2D2, malware, Windows 7.
We have nice here.
Inside it.
We have five samples.
So but in this case today, we are not going to download it for now.
So actually you can get more information and more test images from this official website here.
You can also get the new datasets, popular datasets and like sources like that.
But in this lecture, we're going to use the Windows XP image named Windows Malware, R2D2.
Let's let's actually.
Okay.
So R2D2 and it's used on Windows XP infected operating system as Windows XP Service pack 232 bit here.
And the password is as said here, infected here.
So click on that.
It's just one click and you're going to redirect, redirect it to the Mediafire here and click on download.
Now click on Save file.
Yes, since I have already installed the file name changed by one because the previously installed this
for testing purposes.
Here.
Open here.
And yeah, let's extract this.
As you know, this has this one has the password which is infected.
This is the password here.
And as you can see, this is 200, 268.4MB.
You can extract this like that.
To the desktop here.
Or you can also extract this image by using the terminal Unrar tool here.
Zero 50s here.
Okay.
To move.
To move this to home.
Mom, Kelly Non-desktop.
And, yeah, now we're gonna see the two home Cali desktop and and as you can see here, there is a,
uh, there there is this is the, our file here that we moved to this directory and now we're going
to unroll it so we can see, you can also see the list, the contents of the zero app is here.
Let's here, let's actually move this.
So.
Okay.
Yeah.
We remove this and.
Oops.
Okay, so you can also list the comma, list the files inside RAR packager here with L command L and
zero if T is here.
Enter.
And as you can see, this asks us for password enter the infected.
And yes, you can see that we have one files size of this file, date of this created and time.
So now we're going to honor it here.
Let's see what what files we have.
We have just a folder volatility, which is our volatility framework is installed in it and we have
the RAR file which we're going to extract files from it by by files.
I meant the the virtual memory fire file.
So let's use the on RAR.
Here on Ra, e or E here and R here.
Now enter the zeros here and enter the your password infected.
In fact.
As you can see, it is extracted.
And as you can see, the of virtual memory file is here.
So once the memory file zeros has been extracted to the desktop or the location for your preference,
we can now use the volatility framework framework to analyze the dump.
So whilst dealing with we are within the desktop directory, we can still insert.
As you can see, we installed the stable version of volatility in our previous lectures.
So now we can just list the commands on previous lectures.
So let's see what inside our volatility folder is.
As you can see, there's a volatility 2.5 Linux standalone or CD volatility, and there is our files
here.
So now I'm going to move.
Move this zeros up.
If this memory to our volatility folder inside our volatility lives and create a new folder from in
it.
And so.
No, we will not have to use every time directory to show the program where our virtual memory file
is.
So let's move it on.
Kali desktop zero Ftest Virtual mem to home.
Holly.
Desktop.
Um.
Here.
Volatility.
And.
Yeah.
As you can see here, we move that zero feet memory to it.
And now let's create a make.
Let's create a new directory with make deer and deer here and let's case Oxley.
Oxley case.
Case 001 here.
And we created the new folder here and let's move zero that here to Oxley case.
Oxley case and yeah so now.
Now let's list the commands we can use with volatility.
Volatility, as you can see here, we need to.
Right.
Our toolpath with this characters.
And volatility 64 bit and help common.
Here with this command, with this help command, uh, shows the snippet of some of the many plugins
within the volatility framework.
Here, actually, volatility framework is a very rich and like popular framework in digital forensics
community.
That's why it's actually gone pretty long way and it has like very usable if you know how to use it.
Volatility here.
So I'm going to decrease the font size a little bit so we can see every description of this tools.
Here we have also, as you can see here, shell bags scan, but we can also print the process list as
a tree.
Like we're going to do more examples with this little here.
Don't worry, we will almost use all of this, uh, all of these plugins here.
Here we can also import our plugins in volatility.
Here we can also print a list of loaded details for each process.
So this is like a pretty good tool for digital forensics.
Examiner So the list comes in handy when performing analysis as each plugin comes with its own short
description, as you can see here.
So now we're going to use the image info file here, image info file here, we're going to identify
information for the image.
So for the format plugin volatility, we're going to use the first volatile volatility here.
Now we're going to use the F to specify the file name actually in volatility.
I want to show you that how this is done.
So there is an parameters.
You can use it.
This is the help.
This is the debug volatility.
This is file name We can also use with just a short f.here, lowercase f or just a to here to minus
characters here and then file name equals and enter your file name here.
You can also specify the profile and other parameters here.
So now let's go down and yeah, let's use our file name in as, as you remember we moved.
N.A. Ritual member file to this folder.
Case Oaxaca Case.
Here we've specified the file name and now we're going to use the plugin here.
Image info.
So I want to mention that after plugin you can also use the options, blah blah blah here.
So you can choose also options here.
But in this case I'm I'm not going to choose any options because I want to just show the image info
of our virtual memory file here is determining profile based on CDBG search.
Here.
It's a good practice.
As you can see here.
We outputted and printed all of the information that containing our containing in our virtual memory
file.
So it's a good practice to have the volatility help commands open in the second terminal for easy access
to the commands without having a constantly scroll up and down here.
So we need to choose a profile.
As you can see by the profile, I meant the operating system version to work with in volatility.
So now we're going to choose the profile here.
As you can see here, the suggested profiles is listed here, Windows XP Service Pack two and Windows
XP Service Pack three.
And as you can see here, both of them is 86 here, Architecture 32, which means 32 bit here.
So what is the suggested profile or profile in volatility?
So all operating systems store information in a RAM.
However, they may be situated in different locations within the memory according to the operating system
is used.
So in volatility, we must choose a profile that best identifies the type of operating system and service
pack that helps volatility in identifying locations that store certificates and useful information.
So choosing a profile is relatively simple as what does all the work for us using the image info plugin.
So as you can see, we just mentioned the file path and then mentioned the plugin and it showed us image
info here, number of processors, image type and etcetera etcetera.
So now we're going to.
And here we insert the image info file so we know what we are working on.
This is the memory file of Windows XP Service Pack two.
So.
So here we're going to identify the process processes and analysis.
So to identify and link the processes, their IDs, time started and offset location within the memory,
within the memory image, we will be using the four plugins to get us started.
This is the P list here.
PS list.
History three.
PS scan and ps x.
View here.
In next lectures.
Actually, I will make four separate lectures for these plugins.
So this is the main plugins for use here.
So in next lecture you will learn about the list in this lecture.
Next lecture here.
So I'm waiting you in next lecture.