<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Conducting Memory Forensics — API Reference

## Volatility 3 CLI

### Core Syntax

```bash
vol.py -f <memory_image> <plugin> [options]
```

### Windows Plugins

| Plugin | Purpose | Key Output |
|--------|---------|------------|
| `windows.pslist` | Active process list | PID, PPID, name, offset |
| `windows.psscan` | Scan for all EPROCESS | Includes hidden/terminated |
| `windows.pstree` | Process tree view | Parent-child hierarchy |
| `windows.cmdline` | Process command lines | Full command arguments |
| `windows.dlllist` | Loaded DLLs | DLL paths per process |
| `windows.netscan` | Network connections | Local/remote addr, state, PID |
| `windows.malfind` | Injected code detection | VAD with RWX, hex dump |
| `windows.hashdump` | SAM password hashes | User:RID:LM:NT format |
| `windows.lsadump` | LSA secrets | Service account passwords |
| `windows.cachedump` | Cached domain creds | DCC2 hashes |
| `windows.ssdt` | SSDT hook detection | Hooked syscall entries |
| `windows.callbacks` | Kernel callbacks | Callback routines |
| `windows.driverirp` | IRP hooks | Hooked driver functions |
| `windows.filescan` | File object scan | File paths in memory |
| `windows.handles` | Handle table | Handles per process |
| `windows.registry.hivelist` | Registry hives | Hive paths and offsets |
| `windows.vadinfo` | VAD tree details | Memory region permissions |

### Linux Plugins

| Plugin | Purpose |
|--------|---------|
| `linux.pslist` | Process list |
| `linux.pstree` | Process tree |
| `linux.sockstat` | Socket information |
| `linux.bash` | Bash history from memory |
| `linux.check_syscall` | Syscall table integrity |
| `linux.lsmod` | Loaded kernel modules |
| `linux.check_idt` | IDT integrity check |
| `linux.proc.Maps` | Process memory maps |

### Common Options

```bash
# Filter by PID
vol.py -f mem.raw windows.pslist --pid 1234

# Dump process memory
vol.py -f mem.raw windows.memmap --dump --pid 1234 -o /output/

# Dump DLLs for a process
vol.py -f mem.raw windows.dlllist --dump --pid 1234 -o /output/

# YARA scan
vol.py -f mem.raw yarascan.YaraScan --yara-file rules.yar

# YARA scan specific process
vol.py -f mem.raw yarascan.YaraScan --yara-file rules.yar --pid 1234
```

## String Extraction

```bash
# ASCII strings
strings -a memory.raw > strings-ascii.txt

# Unicode (little-endian) strings
strings -a -el memory.raw > strings-unicode.txt

# Search for specific patterns
strings -a memory.raw | grep -iE "(password|credential|token|apikey)" > strings-sensitive.txt

# Extract URLs
strings -a memory.raw | grep -oE "https?://[a-zA-Z0-9./?=_-]+" | sort -u > strings-urls.txt
```

## bulk_extractor

```bash
# Full extraction
bulk_extractor -o /output/bulk/ memory.raw

# Extract specific scanners
bulk_extractor -o /output/bulk/ -E net -E email memory.raw

# Key output files:
# packets.pcap    — Carved network packets
# email.txt       — Email addresses found
# url.txt         — URLs found
# domain.txt      — Domain names
# ip.txt          — IP addresses
```

## Common Patterns

### Hidden Process Detection

```bash
# Get PIDs from both methods
PSLIST=$(vol.py -f mem.raw windows.pslist 2>/dev/null | awk 'NR>2{print $1}' | sort -n)
PSSCAN=$(vol.py -f mem.raw windows.psscan 2>/dev/null | awk 'NR>2{print $1}' | sort -n)

# PIDs in psscan but not pslist = potentially hidden
comm -23 <(echo "$PSSCAN") <(echo "$PSLIST")
```

### Suspicious Parent-Child Relationships

```
Normal: services.exe → svchost.exe
Normal: explorer.exe → user applications
Suspicious: outlook.exe → powershell.exe
Suspicious: svchost.exe → cmd.exe
Suspicious: services.exe → cmd.exe (direct)
```
