Volatility plugins created by the author
The plugins published here can be used with Volatility v2.4.
BASELINE plugin suite
PROCESSBL A plugin that compares the running processes in 2 memory images - can be used to detect newly started processes - can be used to detect newly loaded DLLs
SERVICESBL A plugin that compares the services in 2 memory images - can be used to detect modification of service configuration - can be used to detect newly installed services
DRIVERBL A plugin that compares the kernel drivers in 2 memory images - can be used to detect newly installed / loaded drivers
MALPROCFIND
A plugin that searches for malicious processes based predefined rules.
Output types: text
INDX
A plugin that carves for and parses INDX ($I30) entries
Output types: text, body
USNJRNL
A plugin that carves for and parses USNJRNL ($J) entries
Output types: text, body
LOGFILE
A plugin that carves for and parses $Logfile entries. It will process the following entry types:
- UPDATE FILENAME ALLOCATION (Partial FILENAME Attributes)
- ADD INDEX ENTRY ALLOCATION (INDX Records)
- DELETE INDEX ENTRY ALLOCATION (INDX Records)
- INITIALIZE FILE RECORD SEGMENT (MFT FILE0 Records)
- DEALLOCATE FILE RECORD SEGMENT (MFT FILE0 Records)
Output types: text, body