Volatility 3 can parse Windows registry hives straight from RAM, even without disk files. Grab hivelist, then printkey walks cells, values and timestamps https://www.valtersit.com/vault/extract-and-parse-offline-windows-registry-hives-from-volati-a9a215/ #volatility3 #registry-forensics #ValtersIT

Volatility 3 malfind spots injected code: it walks each process VAD tree, flags PAGE_EXECUTE_READWRITE regions not backed by disk, then disassembles page https://www.valtersit.com/vault/identify-injected-code-and-shellcode-memory-pages-using-malf-4644e9/
#volatility3 #malware-analysis #ValtersIT

Volatility New Release: #volatility3 v2.28.2 - visit github.com/volatilityfo... for details and downloads.

#memoryforensics #dfir