Source
var cmdline = args.cmd; if (args.profile) { cmdline = cmdline + ' --profile=' + args.profile; } var out = executeCommand('VolJson', {file:args.memdump, system: args.system, cmd:cmdline}); if (out) { var mapper = function(columns) { return function(val) { return val.reduce(function(prev, curr, i) { prev[columns[i]] = '' + curr; return prev; }, {}); }; }; for (var r = 0; r < out.length; r++) { if (out[r].Type !== entryTypes.error) { var jsonout = JSON.parse(out[r].Contents); result = {}; result.Contents = jsonout.rows.map(mapper(jsonout.columns)); result.ContentsFormat = formats.table; result.Type = entryTypes.note; return [result]; } else { result = {}; var errstring = out[r].Contents; result.Contents = errstring.split('Stderr:')[1]; result.ContentsFormat = formats.text; result.Type = entryTypes.error; return [result]; } } }
README
The Volatility integration and automation rely on the D2 agent, which has been deprecated.
Therefore, the Volatility content is marked as deprecated.
No available replacement.
Executes a volatility with command and returns a tabular output. In cases where proper JSON output is not supported, scripts will return errors. The User should use the raw command.
Script Data
| Name | Description |
|---|---|
| Script Type | javascript |
| Tags | memory, forensics, volatility, server |
Inputs
| Argument Name | Description |
|---|---|
| cmd | The Volatility command/module to be uses. |
| memdump | The path to memory dump the file on the system being used. |
| system | The system with Volatility installed to be used for the analysis. |
| profile | The Volatility profile to use. |
Outputs
There are no outputs for this script.