diff --git a/doc/source/Linux.rst b/doc/source/getting-started-linux-tutorial.rst similarity index 71% rename from doc/source/Linux.rst rename to doc/source/getting-started-linux-tutorial.rst index ea6c2223c..15a1f0d1b 100644 --- a/doc/source/Linux.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -1,31 +1,34 @@ Linux Tutorial ============== -This guide will give you a brief overview of how volatility3 works as well as a demonstration of several of the plugins available in the suite of plugins. +This guide will give you a brief overview of how volatility3 works as well as a demonstration of several of the plugins available in the suite. Acquiring memory ---------------- -Volatility3 does not provide the ability to acquire memory. -You can use any of the following tools to Acquire memory or the ones you are convenient with: - - `AVML - Acquire Volatile Memory for Linux `_ - - `LIME - Linux Memory Extract `_ +Volatility3 does not provide the ability to acquire memory. Below are some examples of tools that can be used to acquire memory, but more are available: + +* `AVML - Acquire Volatile Memory for Linux `_ +* `LIME - Linux Memory Extract `_ Procedure to create symbol tables for linux -------------------------------------------- -To create a symbol table please refer this :ref:`symbol-tables:Mac or Linux symbol tables`. +To create a symbol table please refer to :ref:`symbol-tables:Mac or Linux symbol tables`. -.. tip:: We can also find some ISF files from `Linux ISF Server `_ , which is built and maintained by `kevthehermit `_. - After creating the file or downloading the file from the ISF server, please place the file under the directory ``volatility3/symbols/linux``. Make a directory linux under symbols. +.. tip:: It may be possible to locate pre-made ISF files from the `Linux ISF Server `_ , + which is built and maintained by `kevthehermit `_. + After creating the file or downloading it from the ISF server, place the file under the directory ``volatility3/symbols/linux``. + If necessary create a linux directory under the symbols directory (this will become unncessary in future versions). Listing plugins --------------- -Following are the sample of linux plugins available for volatility3. More plugins will be available on future releases. -For plugin requests, Please create an issue with description of the plugin. +The following is a sample of the linux plugins available for volatility3, it is not complete and more more plugins may +be added. For a complete reference, please see the volatility 3 :doc:`list of plugins `. +For plugin requests, please create an issue with a description of the requested plugin. .. code-block:: shell-session @@ -36,13 +39,13 @@ For plugin requests, Please create an issue with description of the plugin. linux.check_creds.Check_creds linux.check_idt.Check_idt -.. note:: Here the the command is piped to grep and head in-order to give you sample list of linux plugins. +.. note:: Here the the command is piped to grep and head in-order to provide the start of the list of linux plugins. Using plugins ------------- -The following is the syntax to run volatility tool. +The following is the syntax to run the volatility CLI. .. code-block:: shell-session @@ -52,11 +55,11 @@ The following is the syntax to run volatility tool. Example ------- -Example 1 -~~~~~~~~~ +banners +~~~~~~~ -In this example we will be using memory dump from Insomni'hack teaser 2020 CTF. Challenge name Getdents. We will limit the discussion to memory forensics with volatility3 and not extend to other parts of the challenges. -I'd like to say thanks to `stuxnet `_ for providing this memory dump and `writeup `_. +In this example we will be using a memory dump from the Insomni'hack teaser 2020 CTF Challenge called Getdents. We will limit the discussion to memory forensics with volatility 3 and not extend it to other parts of the challenge. +Thanks go to `stuxnet `_ for providing this memory dump and `writeup `_. .. code-block:: shell-session @@ -75,11 +78,13 @@ I'd like to say thanks to `stuxnet `_ for provid 0x7fde0010 Linux version 4.15.0-72-generic (buildd@lcy01-amd64-026) (gcc version 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)) #81-Ubuntu SMP Tue Nov 26 12:20:02 UTC 2019 (Ubuntu 4.15.0-72.81-generic 4.15.18) -This above command helps us to find the memory dump's kernel version and the distribution version. Now using the above banner we can search for ISF file from the ISF server. -If you do not find the ISF file then, please follow the instructions on :ref:`Linux:Procedure to create symbol tables for linux`. After that place the ISF file under ``volatility3/symbols/linux`` directory. +The above command helps us to find the memory dump's kernel version and the distribution version. Now using the above banner we can search for the needed ISF file from the ISF server. +If ISF file cannt be found then, follow the instructions on :ref:`getting-started-linux-tutorial:Procedure to create symbol tables for linux`. After that, place the ISF file under the ``volatility3/symbols/linux`` directory. .. tip:: Use the banner text which is most repeated to search from ISF Server. +linux.pslist +~~~~~~~~~~~~ .. code-block:: shell-session @@ -109,6 +114,9 @@ If you do not find the ISF file then, please follow the instructions on :ref:`Li ``linux.pslist`` helps us to list the processes which are running, their PIDs and PPIDs. +linux.pstree +~~~~~~~~~~~~ + .. code-block:: shell-session $ python3 vol.py -f memory.vmem linux.pstree @@ -148,9 +156,12 @@ If you do not find the ISF file then, please follow the instructions on :ref:`Li ***** 1548 1266 gsd-keyboard ***** 1550 1266 gsd-media-keys -``linux.pstree`` helps us to display the parent child relation of processes. +``linux.pstree`` helps us to display the parent child relationships between processes. -Now to find the commands ran in bash shell. Lets use ``linux.bash``. +linux.bash +~~~~~~~~~~ + +Now to find the commands that were run in the bash shell by using ``linux.bash``. .. code-block:: shell-session diff --git a/doc/source/Windows.rst b/doc/source/getting-started-windows-tutorial.rst similarity index 71% rename from doc/source/Windows.rst rename to doc/source/getting-started-windows-tutorial.rst index 80bc6ddc2..c89b065f5 100644 --- a/doc/source/Windows.rst +++ b/doc/source/getting-started-windows-tutorial.rst @@ -1,21 +1,23 @@ Windows Tutorial ================ -This guide gives you a brief introduction to how volatility3 works and some demonstration on suite of plugins available from +This guide provides a brief introduction to how volatility3 works as a demonstration of several of the plugins available in the suite. Acquiring memory ---------------- Volatility does not provide the ability to acquire memory. -You can use any of the following tools to Acquire memory or the ones you are convenient with: - - `WinPmem `_ - - `FTK Imager `_ +Memory can be acquired using a number of tools, below are some examples but others exist: + +* `WinPmem `_ +* `FTK Imager `_ Listing Plugins --------------- -Following are the sample of linux plugins available for volatility3. More plugins will be available on future releases. -For plugin requests, Please create an issue with description of the plugin. +The following is a sample of the windows plugins available for volatility3, it is not complete and more more plugins may +be added. For a complete reference, please see the volatility 3 :doc:`list of plugins `. +For plugin requests, please create an issue with a description of the requested plugin. .. code-block:: shell-session @@ -24,14 +26,13 @@ For plugin requests, Please create an issue with description of the plugin. windows.cmdline.CmdLine windows.crashinfo.Crashinfo windows.dlllist.DllList - Lists the loaded modules in a particular windows -.. note:: Here the the command is piped to grep and head in-order to give you sample list of windows plugins. +.. note:: Here the the command is piped to grep and head in-order to provide the start of a list of the available windows plugins. Using plugins ------------- -The following is the syntax to run volatility tool. +The following is the syntax to run the volatility CLI. .. code-block:: shell-session @@ -41,13 +42,14 @@ The following is the syntax to run volatility tool. Example ------- -Example 1 -~~~~~~~~~ +windows.pslist +~~~~~~~~~~~~~~ -In this example we will be using memory dump from PragyanCTF'22. -We will limit the discussion to memory forensics with volatility3 and not extend to other parts of the challenges. +In this example we will be using a memory dump from the PragyanCTF'22. +We will limit the discussion to memory forensics with volatility 3 and not extend it to other parts of the challenges. -In windows memory forensics using volatility3, most of the times we do not require creating a ISF file. +When using windows plugins in volatility 3, the required ISF file can often be generated from PDB files automatically +downloaded from Microsoft servers, and therefore does not require locating or adding specific ISF files to the volatility 3 symbols directory. .. code-block:: shell-session @@ -64,7 +66,10 @@ In windows memory forensics using volatility3, most of the times we do not requi 412 396 csrss.exe 0xfa80021c5b30 9 224 1 False 2022-02-07 16:30:13.000000 N/A Disabled 468 396 winlogon.exe 0xfa8002284060 5 113 1 False 2022-02-07 16:30:14.000000 N/A Disabled -``windows.pslist`` helps us list the processes running while the memory dump was taken. +``windows.pslist`` helps list the processes running while the memory dump was taken. + +windows.pstree +~~~~~~~~~~~~~~ .. code-block:: shell-session @@ -90,10 +95,12 @@ In windows memory forensics using volatility3, most of the times we do not requi ** 616 504 svchost.exe 0xfa8002b86ab0 13 314 0 False 2022-02-07 16:32:16.000000 N/A ** 624 504 svchost.exe 0xfa8002410630 10 350 0 False 2022-02-07 16:30:14.000000 N/A -``windows.pstree`` helps us to display the parent child relation of processes. +``windows.pstree`` helps to display the parent child relationships between processes. -.. note:: Here the the command is piped to head in-order to give you smaller output of process here top 20. +.. note:: Here the the command is piped to head in-order to provide smaller output, here listing only the first 20. +windows.hashdump +~~~~~~~~~~~~~~~~ .. code-block:: shell-session @@ -108,7 +115,7 @@ In windows memory forensics using volatility3, most of the times we do not requi HomeGroupUser$ 1002 aad3b435b51404eeaad3b435b51404ee af10ecac6ea817d2bb56e3e5c33ce1cd Dennis 1003 aad3b435b51404eeaad3b435b51404ee cf96684bbc7877920adaa9663698bf54 -``windows.hashdump`` helps us to list the hashes of the users in the system. +``windows.hashdump`` helps to list the hashes of the users in the system. diff --git a/doc/source/index.rst b/doc/source/index.rst index 0d35b02ba..9b1d05858 100644 --- a/doc/source/index.rst +++ b/doc/source/index.rst @@ -7,7 +7,7 @@ Volatility 3 is Open Source. :doc:`List of plugins ` -Here are some guidelines for using Volatility 3 effectively: +Below is the main documentation regarding volatility 3: .. toctree:: :caption: Documentation @@ -19,6 +19,14 @@ Here are some guidelines for using Volatility 3 effectively: volshell glossary +There is also some information to get you started quickly: + +.. toctree:: + :caption: Getting Started + + getting-started-linux-tutorial + getting-started-windows-tutorial + .. toctree:: :caption: Python Packages @@ -26,14 +34,6 @@ Here are some guidelines for using Volatility 3 effectively: volatility3 -.. toctree:: - :caption: Getting Started - - FAQ - Installation - Linux - Windows - Indices and tables ================== diff --git a/doc/source/symbol-tables.rst b/doc/source/symbol-tables.rst index d912d4906..b7c26e046 100644 --- a/doc/source/symbol-tables.rst +++ b/doc/source/symbol-tables.rst @@ -41,7 +41,7 @@ The :envvar:`PYTHONPATH` environment variable is not required if the Volatility or a virtual environment. Mac or Linux symbol tables ------------------------ +-------------------------- For Mac/Linux systems, both use the same mechanism for identification. The generated files contain an identifying string (the operating system banner), which Volatility's automagic can detect. Volatility caches the mapping between the strings and the symbol