Description: In this video I will show you how to use Volatility Framework for network information gathering from the memory and dump registry for password hashes and lot more.
Commands for network and registry analysis.
• Networking
Connections
To view the active connections.
Connscan
To find connection structures using pool tag scanning.
Sockets
To detect listening sockets for any protocol TCP, UDP, RAW.
Sockscan
To find socket structures using pool tag scanning.
• Registry
Hivescan
To find the physical addresses of CMHIVEs registry hives in memory.
Hivelist
To locate the virtual addresses of registry hives in memory.
Printkey
To display the subkeys, values, data, and data types contained within a specified registry key.
Hashdump
To extract and decrypt cached domain credentials stored in the registry.
Userassist
To get the UserAssist keys from a sample you can use the userassist plugin
Source : - http://code.google.com/p/volatility/wiki/CommandReference
Tags: memory , forensics , network , registry ,
Disclaimer: We are a infosec video aggregator and this video is linked from an external website. The original author may be different from the user re-posting/linking it here. Please do not assume the authors to be same without verifying.