Volatility notes
When you start using Volatility for the first time, you will encounter the problem like me, Should I use Volatility 2 or 3
The version problems
I'm very stressed when using volatility because of the version, you have to use vol2 and vol3 together because some jobs require you to use vol2 because vol3 doesn't have that type of function and vol2 does the job better than vol3 (or other way around)
So get use to it. After you install the vol2 and 3 you should set up an alias for vol.py to vol2 (for better clarity) add this to your .bashrc or .zsh -> Make your life easier
Practical Notes
How to fix annoying errors from volatility
You will come across this once or twice or maybe a thousand times, I have already been in that situation before and now I'm here to show you how to fix it
Installation and Plugins error
Symbol error (Vol3)
When you install vol3 from the source, on the first run you will something get this error
How to dump the file
Most of you when you started out this Forensic thing if you struggle with how to dump a file from memory like me then here we go [Dump File flow chart]
Do you want to dump the file?
You got to have its offset or physical address
Plugins Links
Last updated
Was this helpful?