- Added concluding section to guide users toward further plugin exploration
- Provided command to list all supported Linux plugins in Volatility 3
- Encouraged community contribution by highlighting the open-source nature of the project
- Linked to the official Volatility 3 GitHub repository for contributor reference
- Added new section for linux.malfind plugin under Using plugins
- Included example output showing detection of suspicious executable memory regions
- Explained how to interpret fields such as anonymous mapping, rwx protection, and disassembly
- Highlighted analysis tips for identifying potential code injection or fileless malware
- Added linux.ip.Addr and linux.ip.Link examples to the Using plugins section
- Highlighted the importance of network configuration in memory forensics
- Explained key fields such as interface state, MAC, IP, namespace, and flags
- Structured the content consistently alongside other plugin examples (pslist, bash, etc.)
- Updated linux.pslist output to include new fields: OFFSET, UID/GID, creation time, and file output
- Added detailed explanation of each column and its forensic significance
- Revised linux.pstree section to reflect new output format including OFFSET and hierarchical indentation
- Emphasized the utility of both plugins for process analysis and anomaly detection
- Added new section for linux.boottime plugin
- Demonstrated how to extract system boot time from memory
- Explained its relevance for timeline analysis and incident response
- Removed outdated instructions referencing the ISF server
- Updated guidance to reflect current method of manually generating ISF files
- Clarified placement of ISF files under volatility3/symbols for automatic detection
- Replaced outdated and partial plugin list with a concise summary
- Mentioned total number of supported Linux plugins (~40+)
- Highlighted representative plugins such as pslist, bash, lsmod, etc.
- Provided updated command to enumerate all available Linux plugins
- Removed outdated reference to the Linux ISF Server (service no longer available)
- Updated symbol table instructions to reflect current volatility3 behavior
(symbol files now auto-detected from volatility3/symbols directory)
This adds a new classmethod, `list_processes_from_kernel`, updates the
`list_processes` method signature to use only the kernel module name and
the context instead of splitting information about the kernel between
the layer_name and symbol_table_name paramters, and does a major version
number increase on the plugin.
Also updates the documentation to reflect pslist method signature
change.
Co-authored-by: Andrew Case <andrew@dfir.org>
cpuu