WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 12:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1396 from j-t-1/windows

Browse Source 
Tweak the getting started windows tutorial
This commit is contained in:
ikelos
2024-12-16 22:44:32 +00:00
committed by GitHub
parent b6717d80d9 d77d696e2b
commit 88537066fa
1 changed files with 5 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/source/getting-started-windows-tutorial.rst
+5 -11
View File
@@ -15,19 +15,19 @@ Memory can be acquired using a number of tools, below are some examples but othe
Listing Plugins
---------------
The following is a sample of the windows plugins available for volatility3, it is not complete and more more plugins may
The following is a sample of the windows plugins available for volatility3, it is not complete and more plugins may
be added. For a complete reference, please see the volatility 3 :doc:`list of plugins <volatility3.plugins>`.
For plugin requests, please create an issue with a description of the requested plugin.
.. code-block:: shell-session
$ python3 vol.py --help | grep windows | head -n 5
$ python3 vol.py --help | grep windows | head -n 4
windows.bigpools.BigPools
windows.cmdline.CmdLine
windows.crashinfo.Crashinfo
windows.dlllist.DllList
.. note:: Here the the command is piped to grep and head in-order to provide the start of a list of the available windows plugins.
.. note:: Here the the command is piped to grep and head to provide the start of a list of the available windows plugins.
Using plugins
-------------
@@ -95,9 +95,9 @@ windows.pstree
** 616 504 svchost.exe 0xfa8002b86ab0 13 314 0 False 2022-02-07 16:32:16.000000 N/A
** 624 504 svchost.exe 0xfa8002410630 10 350 0 False 2022-02-07 16:30:14.000000 N/A
``windows.pstree`` helps to display the parent child relationships between processes.
``windows.pstree`` helps to display the parent-child relationships between processes.
.. note:: Here the the command is piped to head in-order to provide smaller output, here listing only the first 20.
.. note:: Here the the command is piped to head to provide smaller output, here listing only the first 20.
windows.hashdump
~~~~~~~~~~~~~~~~
@@ -116,9 +116,3 @@ windows.hashdump
Dennis 1003 aad3b435b51404eeaad3b435b51404ee cf96684bbc7877920adaa9663698bf54
``windows.hashdump`` helps to list the hashes of the users in the system.