WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-22 01:24:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

last command added to example 1

Browse Source
This commit is contained in:
Tejas
2022-07-03 19:57:16 +05:30
parent 215a434789
commit 69c50e3c65
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/source/Windows.rst
+16
View File
@@ -84,6 +84,22 @@ In windows memory forensics using volatility3, most of the times we do not requi
``windows.pstree`` helps us to display the parent child relation of processes.
.. code-block:: shell-session
$ python3 vol.py -f MemDump.DMP windows.hashdump
Volatility 3 Framework 2.0.3
Progress: 100.00 PDB scanning finished
User rid lmhash nthash
Administrator 500 aad3b435b51404eeaad3b435b51404ee 31d6cfe0d16ae931b73c59d7e0c089c0
Guest 501 aad3b435b51404eeaad3b435b51404ee 31d6cfe0d16ae931b73c59d7e0c089c0
Frank Reynolds 1000 aad3b435b51404eeaad3b435b51404ee a88d1e18706d3aa676e01e5943d15911
HomeGroupUser$ 1002 aad3b435b51404eeaad3b435b51404ee af10ecac6ea817d2bb56e3e5c33ce1cd
Dennis 1003 aad3b435b51404eeaad3b435b51404ee cf96684bbc7877920adaa9663698bf54
``windows.hashdump`` helps us to list the hashes of the users in the system.