Volatility - Networking And Registry Usage

[Praetorian503]

Description: In this video I will show you how to use Volatility Framework for network information gathering from the memory and dump registry for password hashes and lot more.
Commands for network and registry analysis.

• Networking
Connections
To view the active connections.
Connscan
To find connection structures using pool tag scanning.
Sockets
To detect listening sockets for any protocol TCP, UDP, RAW.
Sockscan
To find socket structures using pool tag scanning.

• Registry
Hivescan
To find the physical addresses of CMHIVEs registry hives in memory.
Hivelist
To locate the virtual addresses of registry hives in memory.
Printkey
To display the subkeys, values, data, and data types contained within a specified registry key.
Hashdump
To extract and decrypt cached domain credentials stored in the registry.
Userassist
To get the UserAssist keys from a sample you can use the userassist plugin
Source : - CommandReference - volatility - Example usage cases and output for Volatility 2.0 commands - An advanced memory forensics framework - Google Project Hosting

Disclaimer: We are a infosec video aggregator and this video is linked from an external website. The original author may be different from the user re-posting/linking it here. Please do not assume the authors to be same without verifying.

Original Source:

Source: Volatility - Networking And Registry Usage