How to get Windows information from RAM Dump using Volatility 3? Windows Username and password!!!
Live Forensics
Volatility 3 is the most advanced memory forensics framework!
In this video, you will learn how to use Volatility 3 to analyse memory RAM dump from Windows 10 machine. I will extract OS information and the Windows username and password hashes.
OS Infromation - Imag info
.py -f “/path/to/file” windows.info
Dump the Windows user password hashes.
.py -f “/path/to/file” windows.hashdump
To crack NT Hash use this link https://crackstation.net/ or tools like John the Ripper and Hashcat
If you use any other tools please write them in the comment.