A collection of profiles for Volatility - a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This a public repository containing Volatility profiles that were either found on the Internet or contributed by Volatility users. Feel free to push your own profile if it's not in the repo yet. Though there's no certain naming rule or scheme, it's nice to mention the following in the profile (.zip) name:
- Platform (e.g. "Linux")
- OS (e.g. "Ubuntu")
- Kernel or OS version (e.g. "3.2.0-23-generic" in case of Linux or "10.7.3" in case of Mac OS X)
- Bitness (x86/x64/what_not)
- Other important characteristics like PAE, if the Linux kernel was compiled with Physical Address Extension support. You should append "-pae" to the name of the profile then (see those already in the repo).
If you wish to help but unsure how to create Volatility profiles, here are some links which are part of the official documentation:
- How to create profiles for Linux
- How to create profiles for Mac OS X
- How to create profiles for Android
Currently there are a few profiles for Ubuntu which were downloaded from here, various Linux and Mac profiles are from Volatility's page 1 and 2
PS. If you push a profile you can also tweet about it with hashtag #volatilityprofile or #volatility