• Introduction
• Installation
• Case Studies/Forensic Challenges
• Development and Plugins
• Linux Support
• Older (1.3) Documentation

Introduction

This page contains links to documents that are part of the Volatility Documentation Project (VDP) 2.0. These documents are contributed by various members of the Volatility community. New contributions are always welcome.

Installation

• Full Development Installation

Case Studies/Forensic Challenges

• Hunting Malware with Volatility 2.0 by Frank Boldewin (external link)
• Abstract Memory Analysis: Zeus Encryption Keys (external link)
• Analyzing Malware Hollow Processes (external link)
• Analyzing the New Honeynet Memory Analysis Challenge with Volatility (external link)
• Carberp Analysis via Volatility (external link)
• Challenge 7 of the Forensic Challenge 2011 - Forensic Analysis of a Compromised Server (external link)
• CSI:Internet Episode 3: A trip into RAM (external link)
• Dirt Jumper DDoS Bot - New versions, New targets (external link)
• Malware Analysis with SIFT and Volatility - (64 bit) (external link)
• MORTO – From a Memory-Dump Point of View (external link)
• Running Volatility Memory Forensics Framework on your android phone! (external link)
• Shylock via volatility (external link)
• Shylock In-Depth Malware Analysis (external link)
• Stuxnet's Footprint in Memory with Volatility 2.0 (external link)
• toolsmith: Memory Analysis with DumpIt and Volatility (external link)
• Using "volatility" to study the CVE-2011-0611 Adobe Flash 0-day (external link)
• Volatility Memory Forensics | Basic Usage for Malware Analysis (external link)
• Volatility Memory Forensics | Federal Trojan aka R2D2 (external link)
• Volatility Memory Forensics | Graphviz (external link)
• ZeroAccess, Volatility, and Kernel Timers (external link)
• Zeus Analysis in Volatility 2.0 (external link)

Development and Plugins

• Adding new structure definitions to Volatility (external link)
• Converting Volatility 1.3 Plugins to 2.0
• Plugin Writers Guide
• reglist (external link)
• Volatility 2.0: Timeliner, RegistryAPI, evtlogs and more (external link)
• Volatility 2.0 Plugin Vscan (external link)
• RAM dump with VirtualBox: via ELF64 coredump (external link)

Linux Support

• Bringing Linux Support To Volatility (external link)
• Analyzing the New Honeynet Memory Challenge with Volatility by Andrew Case. (external link)
• The winning submissions to Honeynet's Forensic Challenge #7, which leveraged Volatility. (external link)
• Linux Memory Analysis Workshop at Blackhat USA 2011 by Andrew Case (external link)

Older (1.3) Documentation

• VDP 1.3