关于我在windows使用volatility取证这档事

article/2025/9/18 5:35:34

官网下载地址：https://www.volatilityfoundation.org/releases

volatility3的官方文档：https://volatility3.readthedocs.io/en/latest/basics.html

下载

看清有两个版本，用法不一样

在这里插入图片描述
第一次我下载了Volatility 2.6 Windows Standalone Executable (x64)
结果执行Volatility.exe老是报出error
然后我果断删除了2.6
下载了3.0

版本差异

在这里插入图片描述而volatility2的用法如下

volatility -f 'Windows 7-dde00fa9.vmem' imageinfo

volatility3插件功能

下面使用python vol.py -h看volatility3的插件都有哪些
下面插件只是简单罗列，准备再写一篇文章单独介绍

pluginbanners.Banners     configwriter.ConfigWriterframeworkinfo.FrameworkInfo isfinfo.IsfInfo   layerwriter.LayerWriterlinux.bash.Bash     linux.check_afinfo.Check_afinfolinux.check_creds.Check_credslinux.check_idt.Check_idtlinux.check_modules.Check_moduleslinux.check_syscall.Check_syscall  linux.elfs.Elfs  linux.keyboard_notifiers.Keyboard_notifiers linux.lsmod.Lsmod linux.lsof.Lsof    linux.malfind.Malfindlinux.proc.Maps    linux.pslist.PsListlinux.pstree.PsTreelinux.tty_check.tty_checkmac.bash.Bash      mac.check_syscall.Check_syscallmac.check_sysctl.Check_sysctlmac.check_trap_table.Check_trap_tablemac.ifconfig.Ifconfigmac.kauth_listeners.Kauth_listenersmac.kauth_scopes.Kauth_scopesmac.kevents.Keventsmac.list_files.List_Filesmac.lsmod.Lsmod     mac.lsof.Lsof       mac.malfind.Malfindmac.mount.Mount    mac.netstat.Netstatmac.proc_maps.Maps  mac.psaux.Psaux     mac.pslist.PsList   mac.pstree.PsTree  mac.socket_filters.Socket_filtersmac.timers.Timers   mac.trustedbsd.Trustedbsdmac.vfsevents.VFSeventstimeliner.Timelinerwindows.bigpools.BigPoolswindows.cmdline.CmdLinewindows.dlllist.DllListwindows.driverirp.DriverIrpwindows.driverscan.DriverScanwindows.dumpfiles.DumpFileswindows.envars.Envarswindows.filescan.FileScanwindows.getservicesids.GetServiceSIDswindows.getsids.GetSIDswindows.handles.Handleswindows.info.Info   windows.malfind.Malfindwindows.memmap.Memmapwindows.modscan.ModScanwindows.modules.Moduleswindows.mutantscan.MutantScanwindows.netscan.NetScan      windows.poolscanner.PoolScannerwindows.privileges.Privswindows.pslist.PsListwindows.psscan.PsScanwindows.pstree.PsTreewindows.registry.certificates.Certificateswindows.registry.hivelist.HiveListwindows.registry.hivescan.HiveScanwindows.registry.printkey.PrintKeywindows.registry.userassist.UserAssistwindows.ssdt.SSDT   windows.statistics.Statisticswindows.strings.Strings           windows.symlinkscan.SymlinkScanwindows.vadinfo.VadInfowindows.verinfo.VerInfowindows.virtmap.VirtMapThe following plugins could not be loaded (use -vv to see why):
volatility3.plugins.windows.cachedump, volatility3.plugins.windows.callbacks,
volatility3.plugins.windows.hashdump, volatility3.plugins.windows.lsadump,
volatility3.plugins.windows.svcscan, volatility3.plugins.windows.vadyarascan,
volatility3.plugins.yarascan

注意最下面提示有一些插件不能加载
使用-vv查看原因

python vol.py -vvVolatility 3 Framework 1.0.0
INFO     root        : Volatility plugins path: ['D:\\Tools\\volatility3-1.0.0\\volatility3\\plugins', 'D:\\Tools\\volatility3-1.0.0\\volatility3\\framework\\plugins']
INFO     root        : Volatility symbols path: ['D:\\Tools\\volatility3-1.0.0\\volatility3\\symbols', 'D:\\Tools\\volatility3-1.0.0\\volatility3\\framework\\symbols']
INFO     volatility3.plugins.yarascan: Python Yara module not found, plugin (and dependent plugins) not available
DEBUG    volatility3.framework: No module named 'yara'
DEBUG    volatility3.framework: Failed to import module volatility3.plugins.yarascan based on file: yarascan
DEBUG    volatility3.framework: No module named 'Crypto'
DEBUG    volatility3.framework: Failed to import module volatility3.plugins.windows.cachedump based on file: windows\cachedump
INFO     volatility3.plugins.yarascan: Python Yara module not found, plugin (and dependent plugins) not available
DEBUG    volatility3.framework: No module named 'yara'
DEBUG    volatility3.framework: Failed to import module volatility3.plugins.windows.callbacks based on file: windows\callbacks
DEBUG    volatility3.framework: No module named 'Crypto'
DEBUG    volatility3.framework: Failed to import module volatility3.plugins.windows.hashdump based on file: windows\hashdump
DEBUG    volatility3.framework: No module named 'Crypto'
DEBUG    volatility3.framework: Failed to import module volatility3.plugins.windows.lsadump based on file: windows\lsadump
INFO     volatility3.plugins.yarascan: Python Yara module not found, plugin (and dependent plugins) not available
DEBUG    volatility3.framework: No module named 'yara'
DEBUG    volatility3.framework: Failed to import module volatility3.plugins.windows.svcscan based on file: windows\svcscan
INFO     volatility3.plugins.yarascan: Python Yara module not found, plugin (and dependent plugins) not available
DEBUG    volatility3.framework: No module named 'yara'
DEBUG    volatility3.framework: Failed to import module volatility3.plugins.windows.vadyarascan based on file: windows\vadyarascan
INFO     root        : The following plugins could not be loaded (use -vv to see why): volatility3.plugins.windows.cachedump, volatility3.plugins.windows.callbacks, volatility3.plugins.windows.hashdump, volatility3.plugins.windows.lsadump, volatility3.plugins.windows.svcscan, volatility3.plugins.windows.vadyarascan, volatility3.plugins.yarascan
usage: ....................
volatility: error: Please select a plugin to run