#shorts
Live Forensics
In this video, you will learn how to use Volatility 3 to analyse memory RAM dump from Windows 10 machine. I will extract the telnet network connection information to get the target IP address, port, machine name, username and password.
Volatility has several plugins for listing the network information and connections within the running system at the time of dump creation.
Windows.NetScan, allows you to obtain: Offset location, Protocol, local IP address and port, Foreign IP Address and port, Process ID PID, the owned program and the creation details. Spend some time viewing all connections.
You can view the active processes using windows.pslist, which will show the processes running on the system at the time of dump creation
You can pip "|" the output into a select-string command to filter and find only the line that has Telent.
windows.memmap allows you to extract the memory data related to PID from the memory dump
You can use the Strings command with the context option to analyse and view the extracted memory data.