AnalyzeMemImage

Use Volatility to run common memory image analysis commands

Source

var imginfo = executeCommand('Vol', {file:args.memdump, system: args.system, cmd:'imageinfo'});
if (imginfo) {
   imginfo[0].Contents = '================ Image Info for ' + args.memdump + '==============\n' + imginfo[0].Contents;
}
var pstree = executeCommand('Vol', {file:args.memdump, system: args.system, cmd:'pstree'});
if (pstree) {
   pstree[0].Contents = '================ Process Tree for ' + args.memdump + '==============\n' + pstree[0].Contents;
}
var connscan = executeCommand('Vol', {file:args.memdump, system: args.system, cmd:'connscan'});
if (connscan) {
   connscan[0].Contents = '================ Past Network Connections for ' + args.memdump + '==============\n' + connscan[0].Contents;
}
var res = [];
res.push(imginfo);
res.push(pstree);
res.push(connscan);
return res;

README

Runs common memory image analysis commands.

Script Data

Name	Description
Script Type	javascript
Tags	memory, forensics, volatility, server

Inputs

Argument Name	Description
memdump	The path to memory dump the file on the system being used.
system	The system with `Volatility` installed to be used for the analysis.

Outputs

There are no outputs for this script.