Volatility Deprecated

Deprecated. No available replacement.

javascript · Volatility (Deprecated)

Source

var cmdline = args.cmd;
if (args.profile) {
    cmdline = cmdline + ' --profile=' + args.profile;
}
var out = executeCommand('VolJson', {file:args.memdump, system: args.system, cmd:cmdline});
if (out) {
    var mapper = function(columns) {
        return function(val) {
            return val.reduce(function(prev, curr, i) {
                prev[columns[i]] = '' + curr;
                return prev;
            }, {});
        };
    };
    for (var r = 0; r < out.length; r++) {
        if (out[r].Type !== entryTypes.error) {
            var jsonout = JSON.parse(out[r].Contents);
            result = {};
            result.Contents = jsonout.rows.map(mapper(jsonout.columns));
            result.ContentsFormat = formats.table;
            result.Type = entryTypes.note;
            return [result];
        }
        else
        {
            result = {};
            var errstring = out[r].Contents;
            result.Contents = errstring.split('Stderr:')[1];
            result.ContentsFormat = formats.text;
            result.Type = entryTypes.error;
            return [result];
        }
    }
}

README

The Volatility integration and automation rely on the D2 agent, which has been deprecated.
Therefore, the Volatility content is marked as deprecated.
No available replacement.

Executes a volatility with command and returns a tabular output. In cases where proper JSON output is not supported, scripts will return errors. The User should use the raw command.

Script Data


Name Description
Script Type javascript
Tags memory, forensics, volatility, server

Inputs


Argument Name Description
cmd The Volatility command/module to be uses.
memdump The path to memory dump the file on the system being used.
system The system with Volatility installed to be used for the analysis.
profile The Volatility profile to use.

Outputs


There are no outputs for this script.