Skip to content

volatility3: add page #16383

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Conversation

AndrewK3652
Copy link
Contributor

created page for volatility3

  • The page(s) are in the correct platform directories: common, linux, osx, windows, sunos, android, etc.
  • The page(s) have at most 8 examples.
  • The page description(s) have links to documentation or a homepage.
  • The page(s) follow the content guidelines.
  • The page(s) follow the style guide.
  • The PR title conforms to the recommended templates.
  • Version of the command being documented (if known):

created page for volatility3
@github-actions github-actions bot added new command Issues requesting creation of a new page or PRs adding a new page for a command. review needed Prioritized PRs marked for reviews from maintainers. labels May 4, 2025
@nelsonfigueroa nelsonfigueroa changed the title Create volatility3.md volatility3: add page May 4, 2025
Copy link
Member

@sebastiaanspeck sebastiaanspeck left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This page should be moved to the Windows folder; the examples you described apply to the Windows plugins

Co-authored-by: Sebastiaan Speck <[email protected]>

- Display help:

`python3 vol.py -h`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
`python3 vol.py -h`
`python3 vol.py {{[-h|--help]}}`


- Get information about a memory dump file:

`python3 vol.py -f {{path/to/memory_dump_file}} windows.info`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
`python3 vol.py -f {{path/to/memory_dump_file}} windows.info`
`python3 vol.py {{[-f|--filename]}} {{path/to/memory_dump_file}} windows.info`


- List active processes:

`python3 vol.py -f {{path/to/ memory_dump_file}} windows.pslist`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
`python3 vol.py -f {{path/to/ memory_dump_file}} windows.pslist`
`python3 vol.py {{[-f|--filename]}} {{path/to/memory_dump_file}} windows.pslist`


- List hashes of users on system:

`python3 vol.py -f {{path/to/ memory_dump_file}} windows.hashdump`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
`python3 vol.py -f {{path/to/ memory_dump_file}} windows.hashdump`
`python3 vol.py {{[-f|--filename]}} {{path/to/memory_dump_file}} windows.hashdump`


- List active network connections:

`python3 vol.py -f {{path/to/ memory_dump_file}} windows.netstat`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
`python3 vol.py -f {{path/to/ memory_dump_file}} windows.netstat`
`python3 vol.py {{[-f|--filename]}} {{path/to/memory_dump_file}} windows.netstat`

@fazlearefin
Copy link
Member

fazlearefin commented May 7, 2025

This page should be moved to the Windows folder; the examples you described apply to the Windows plugins

@sebastiaanspeck Based on the wiki, it can be used in Windows/Linux/macOS. So I think having this in common is fine. It is just that his examples are for Windows only.

@sebastiaanspeck
Copy link
Member

But why not have a specific page for each OS and a overview page in common?

@Managor
Copy link
Collaborator

Managor commented May 7, 2025

That's a good idea. See gcrane-completion.md as an example

@fazlearefin fazlearefin added the waiting Issues/PRs with Pending response by the author. label May 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
new command Issues requesting creation of a new page or PRs adding a new page for a command. review needed Prioritized PRs marked for reviews from maintainers. waiting Issues/PRs with Pending response by the author.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants