Malware and Memory Forensics Training Goes Virtual!

We are very excited to announce that our popular Malware and Memory Forensics with Volatility training is now available in a self-paced, online format!

Brought to you by members of the Volatility Team, this course gives you the opportunity to learn directly from the people behind the research and development of Volatility, and it offers you a chance to support our ongoing efforts.

The Course

Our course provides a deep examination of Windows internals, malware operations, attacker toolkits, DFIR workflows, and how memory forensics can be leveraged throughout all of your investigations. The end result of the lectures on these topics is a complete understanding of how memory analysis tools operate, along with the traces left behind by malicious actors and applications. You will gain knowledge that applies to all memory analysis investigations and frameworks, both now and in the future.

The Labs

You will get significant hands-on experience using Volatility against Windows, Linux, and MacOS samples during the training labs. These labs are mirrored directly to match our real-world investigations (1, 2, 3, 4, 5), and they are constantly updated as new threats emerge. After each lab, there is a pre-recorded walkthrough that shows you the precise steps taken to solve the lab as well as explains the rationale behind the workflow used. A written version of the walkthrough is also provided in the Lab Guide.

The Content

Signing up for the course provides you with 4 months of access to all material, including the pre-recorded lectures, demos, and lab walkthroughs. You will also be given a trial version of Surge Collect Pro, which provides reliable and secure memory acquisition across Windows, Linux, and Mac systems. For support, we have a dedicated channel on our Slack server and periodic office hours via Zoom; students can directly ask us questions about any portion of the course, with optional screen sharing. After the course ends, you may retain access to the written materials (Art of Memory Forensics, course slides, lab guide) and the course virtual machine. You are also welcome to stay in the student-only Slack channel and join our alumni-only mailing list.

For those wondering about Volatility 2 vs Volatility 3, our course currently uses Volatility 2 for demos and labs as it is the stable and fully featured version of The Volatility Framework. As mentioned previously, the skills learned in this course are transferable to any memory analysis framework – even those not based on Volatility. We plan to add training modules specific to Volatility 3 slowly over time as it stabilizes and further approaches feature- and plugin-parity with Volatility 2. In general, if you know how to use Volatility 2, then using Volatility 3 will be very simple in the future. As students of this course, you will be the first to gain access to Volatility 3 training material as it is released.

Sign Up!

You can request access to the course here. We provide discounts for military, law enforcement, and groups of students from the same organization. We also provide significant discounts to course alumni who wish to take the course again, as well as to full-time college students studying in a related field. Please inquire about these discounts if you meet the requirements. We can also accommodate private sessions for large group trainings.

We would like to thank the memory forensics community for their years of continued support. We are excited that our course is now available 24/7/365 for students around the world!

- The Volatility Team

Volatility Malware and Memory Forensics Training in 2020!

We are excited to announce that in 2020 we will have 4 public offerings of our highly popular Malware and Memory Forensics training course. These offerings include:

• March 9-13, San Diego, CA
• April 20-24, Herndon, VA
• September 21-25, Amsterdam, NL 
• October 19-23, Herndon, VA [Date revised from original announcement]

Our incident-driven, cutting-edge material is one of the main reasons students value our course. We don't teach the same concepts year after year. Instead, we update our class regularly to stay in sync with (and in some cases, ahead of) rapidly changing attack surfaces, advances in defense technologies, malware hiding tricks, and operating system forensics artifacts. A few recent additions include:

• Updated memory analysis techniques for ongoing Windows 10 changes
• Analysis of "stealthy" mechanisms to hide memory-only code
• Automatic comparisons of live forensics data to memory forensics data for detection of malware
• Scalable and automated memory acquisition of Linux systems
• Memory acquisition challenges from OS X Catalina systems

Not only only will you be learning these memory forensics topics directly from the authors of the Volatility Framework and the Art of Memory Forensics, but you will also receive Volatility stickers, a branded USB drive, a copy of the Art of Memory Forensics (digital or print), and various opportunities to win SyncStops - all nicely documented by a few past students:

An awesome training class from @volatility. Lived up to every great review I've read.
Kudos to @attrc and @iMHLv2 pic.twitter.com/xcf4eXfHQT

— Brian Baskin (@bbaskin) October 18, 2019

Learned a ton, won some stuff, got free drinks. Had an excellent week attending @volatility training. 😊 pic.twitter.com/ZK4OioYCiz

— Sarah (@StarSlaughter) April 21, 2018

One of the most popular class contests is our CTF that pits individuals (or teams of two) against the rest of the class, in a challenge that involves analyzing Windows and Linux memory samples in a scenario resembling events that unfolded during the 2016 U.S. Presidential Election.

Swag including coffee mugs, t shirts, and @volatility branded @SyncStop devices for our training CTF winners #dfir #memoryforensics pic.twitter.com/z5kKS4DTnf

— volatility (@volatility) April 20, 2018

To continue providing the most up-to-date memory forensics training available anywhere in the world, our instructors constantly perform high-impact, real-world DFIR  (1, 2 3, 4, 5, 6, 7, 8, 9). The knowledge gained during these investigations is immediately transitioned into content and labs for our training courses.

Besides the core knowledge needed to perform effective memory forensics, we also teach the latest tools and techniques for reliable memory acquisition. Students will gain experience using Volexity Surge Collect Pro for robust, fast, and secure collection of Windows, Linux, and OS X memory to local and remote/network-based destinations. Students can purchase Surge licenses at a discounted price during course registration (see Memory Forensics Training FAQ) or separately after the class.

In closing this update, we would again like to thank the DFIR community for its continued support of the Volatility project, including the recent warm reception at OSDFCon 2019. It was great seeing and meeting so many users around the world this year, particularly at OSDFCon, Black Hat, DFRWS, BSidesNOLA, BSidesAustin, BSidesLV, and in Herndon and London.

-- The Volatility Team

Malware and Memory Forensics Training Headed to Herndon and Amsterdam!

After another highly successfully year of our Malware and Memory Forensics training, which included sold-out public trainings in Herndon, VA and London as well as several private trainings, we are excited to announce our lineup of public trainings for 2018.

Our first offering will be back in Herndon in April from the 16th to the 20th. This class is already over 80% full, so please contact us ASAP if you wish to attend this offering.

We will also be back in Herndon for the week of October 15th to the 19^th.  Our Fall classes in the Herndon/Reston area have consistently been the fastest to sell out, so please lock in your seat as early as possible.

Finally, we will be returning to Europe with an offering in Amsterdam in September from the 4th to the 7th. Please note that this class will run Tuesday-Friday instead of the normal Monday-Friday. To make up for the missing time, the Tuesday-Friday sessions will each run until 6PM. 

Our course is constantly evolving in order to cover the latest operating system updates, malware techniques, and attacker tactics. The following highlights some of the new material for our 2018 offerings:

• The effects of Meltdown  and Spectre on memory forensic acquisition and analysis
• The effects of Intel’s SGX, TME, and MPX extensions on memory forensic acquisition and analysis
• The latest tactics of highly advanced threat groups against whom we have performed real-world analysis, such as OceanLotus
• The introduction of Surge Collect Pro for Linux 
• Updated coverage of the security features introduced in Windows 10

As we have in years' past, we will continue to give out tons of swag, including a copy of the Art of Memory Forensics in either digital or printed form:

Loving the swag, particularly the SyncStop. Thanks @volatility team! pic.twitter.com/GEYGcGSN0P

— me (@cyli) February 8, 2016

As well as running our highly popular CTF on the last day of class:

Another epic memory analysis CTF battle between @volatility training students. Congrats to the winners! #DFIR pic.twitter.com/1caH6oGMy9

— volatility (@volatility) April 7, 2017

In closing this update, we would again like to thank the DFIR community for its continued support of the Volatility project and our associated training course.   If you will be at BSidesNOLA, Black Hat Vegas, or OSDFCon later this year then please come introduce yourself in person!

-- The Volatility Team

Our Newly Updated Memory Forensics and Malware Analysis Course is Headed to Herndon and London!

As we head into summer, we wanted to let everyone know that for 2017 we only have two remaining public offerings of our highly popular and newly updated Malware and Memory Forensics training course. If you would like to join us, our international course will be in London during the week of September 18th - 22nd, and our US course will be back in Herndon during the week of October 16th - 20th.

Our cutting edge materials are one of the main reasons students value our course. We don't teach the same concepts year after year. Instead, we update our class regularly, to stay in sync with (and in some cases, ahead of) the rapidly changing attack surfaces, advances in defense technologies, malware hiding tricks, and operating system forensics artifacts. A few recent additions include:

• Windows 10 security features, such as Device Guard, Credential Guard, Isolated User Mode, Protected Processes, etc.
• Challenges of recent hibernation file analysis, the impact of new sleep modes, and hybrid style hibernations 
• How to analyze RAM backed page files on Windows 10 & memory compression 
• The Linux subsystem of Windows 10 and the associated memory artifacts
• Memory-only Powershell and .NET based attacks
• New event log sources that compliment memory forensics

Not only only will you be learning these memory forensics topics directly from the authors of the Volatility Framework and the Art of Memory Forensics, but you will also receive Volatility stickers, a branded USB drive, a copy of the Art of Memory Forensics (digital or print), and various opportunities to win SyncStops - all nicely documented by a former student:

Loving the swag, particularly the SyncStop. Thanks @volatility team! pic.twitter.com/GEYGcGSN0P

— me (@cyli) February 8, 2016

One of the most popular class contests is our CTF that pits individuals (or teams of two) against the rest of the class, in a challenge that involves analyzing Windows and Linux memory samples in a scenario resembling events that unfolded during the 2016 U.S. Presidential Election.

Another epic memory analysis CTF battle between @volatility training students. Congrats to the winners! #DFIR pic.twitter.com/1caH6oGMy9

— volatility (@volatility) April 7, 2017

To continue providing the most up-to-date memory forensics training available anywhere in the world, our instructors constantly perform high impact, real-world DFIR  (1, 2, 3, 4, 5). The knowledge gained during these investigation is immediately transitioned into content and labs for our training courses:

Extracting&analyzing this log file from memory is required to complete 1 of our memory forensics labs. Has been crucial in many real cases https://t.co/YU1hOzIITr

— Andrew Case (@attrc) March 17, 2017

Detecting each of these with memory forensics is covered in full detail in our @volatility training #dfir https://t.co/UOcMRBDhaL

— Andrew Case (@attrc) May 28, 2017

Besides the core knowledge needed to perform effective memory forensics, we also teach the latest tools and techniques for reliable memory acquisition. Students will gain experience using Volexity Surge Collect Pro for robust, fast, and secure collection of Windows memory to local and remote/network-based destinations. Students can purchase Surge licenses at a discounted price during course registration (see Memory Forensics Training FAQ) or separately after the class.

In closing this update, we would again like to thank the DFIR community for its continued support of the Volatility project and our associated training course. In particular, all the newcomers who are just starting to explore memory analysis, as well as our alumni and numerous repeat students who just can't get enough!

On a side note, if you are going to be at DFRWS or Black Hat this summer then be sure to come introduce yourself!

-- The Volatility Team

Volatility Update: Core team is growing!

Next year marks the 10-year anniversary of the first public release of Volatility! This would not have been possible without the friendship and support of the amazing Volatility Community.  One of the original goals of Volatility was to create a project that would help bring together technical talent in the forensics and incident response communities. We also wanted to create a unifying framework that would bring together academics, practitioners, government, and law enforcement from around the world. A platform where the latest cutting edge research being presented at the top academic security conferences could be immediately transitioned into the hands of digital investigators.  In celebration of the past 10 years, we have a number of exciting things planned for 2017.  Along those lines, you may have noticed on the mailing list or on github that the Volatility Core development team is continuing to expand.

For those who have been part of the Volatility Community since the beginning, I’m excited to say that Dr. Nick Petroni has rejoined the team. Nick’s pioneering academic research laid the groundwork for much of the modern work in memory analysis.  He was also one of the original developers of Volatility and his design decisions continue to provide the foundation upon which most modern tools are based.  Similarly, I’m also excited to introduce Anthony Colatrella.  Anthony is one of the best computer scientists I’ve had the pleasure to work with.  During his career, he has focused his time on operating system and security development, including contributions to SELinux.  Both Nick and Anthony are working on a number of impressive projects and I’m sure you will see more of them in the coming months.

Malware and Memory Forensics 2017 Schedule (Now with Linux, Mac, and Surge Collect Pro)

Our most popular training course just got even better! We're happy to announce the curriculum for Malware and Memory Forensics by The Volatility Project now includes the following:

• Linux and Mac OS X memory analysis
• Windows memory acquisition with Volexity Surge Collect Pro
• Several new and challenging hands-on labs based on high profile, real world incidents

We currently have 5 MMF courses open for registration, including our first wave of events in 2017. Registrants of all classes will receive a free copy of The Art of Memory Forensics in hard/paper or electronic (eBook, Mobi, or PDF) format.

2016

August 29th - September 2nd, 2016 in Amsterdam (**nearly sold out)
October 3rd - 7th, 2016 in Herndon, VA (**nearly sold out)

2017

April 3rd - 7th, 2017 in Herndon, VA
September 18th - 22nd, 2017 in London, UK (**our first UK class in 3 years)
October 16th - 20th, 2017 in Herndon, VA

Starting with the 2017 courses, we're offering discounts on Volexity Surge Collect Pro (for Windows) at the time of registration. For more information on this package deal, see our Memory Forensics Training FAQ.

If you're interested in attending, contact us. We look forward to meeting and training with everyone!

Volatility at Black Hat USA & DFRWS 2015!

Due to another year of open research and giving back to the open source community, Volatility will have a strong presence at both Black Hat USA and DFRWS 2015. This includes presentations, a book signing, and even a party!

At Black Hat, the core Volatility Developers (@4tphi, @attrc, @gleeda, and @iMHLv2) will be partaking in a number of events including:

• Demoing Volatility at Black Hat Arsenal. This will include new plugins targeted at the PlugX malware, showing how to write simple, but effective Volatility plugins, and more!

• Book signing for The Art of Memory Forensics starting at 11:10AM on Wednesday in the Black Hat book store. All four authors will be present, so be sure to bring your book along or purchase a copy on-site in the bookstore.

• Volatility Happy Hour: This will be an open bar party where you can meet our team, bring books to be signed, and get Volatility swag all while enjoying tasty beverages. You must register (free) if you wish to attend! Note that the party will be at MGM Grand.

Friends of Volatility will also be leading a number of events at Black Hat including Briefing presentations from Jonathan Brossard, jduck, and Alex Ionescu as well as Arsenal Demos from Brian Baskin, Marc Ochsenmeier, David Cowen, and Takahiro Haruyama.

At DFRWS, Dr. Golden Richard will be presenting a paper that he and I wrote: Advancing Mac OS X Rootkit Detection. In this paper, we present several new methods to detect rootkits on OS X systems through memory forensic analysis. All the of the plugins described in the paper will be incorporated into Volatility after the conference. 

Also, at DFRWS, Joe Sylve and Vico Marziale will be leading a workshop on creating forensics tools in Go. If you have never seen Go before, or want to gain some hands-on experience, then we recommend checking it out.

And finally, be sure to check out the "Finding your naughty BITS" presentation by Matthew Geiger, who has been a long time friend of the project.

We hope to see everyone at these events, and we are looking forward to an exciting August! 

Windows Malware and Memory Forensics Training in the UK

Windows Malware and Memory Forensics Training by The Volatility Project is the only memory forensics course officially designed, sponsored, and taught by the Volatility developers. One of the main reasons we made Volatility open-source is to encourage and facilitate a deeper understanding of how memory analysis works, where the evidence originates, and how to interpret the data collected by the framework's extensive set of plugins. Now you can learn about these benefits first hand from the developers of the most powerful, flexible, and innovative memory forensics tool.

Our last public class in the UK sold out, so we are back again! This training is organized and hosted by CCL Group, the UK's largest provider of digital forensics.

Details

Location: Stratford-Upon-Avon, United Kingdom

Cost: £ 2595 + VAT (lunch provided)

​Dates: Monday June 1st - Friday June 5th 2015

Times: 9 AM - 5 PM daily

Instructors: Michael Ligh, Jamie Levy, Andrew Case 

View this course's full page

Booking

For bookings, please contact training@cclgroupltd.com or call 01789 261200 (UK).

Other Courses

The following courses are also open for registration. 

* April 13-17 in Reston, VA

* May 11-15 in New York, NY

* August 31-September 3 in Amsterdam, NL

Acquiring Memor(ies) from 2014

2014 is extremely volatile. Any minute now, it will be gone. Thus, we wanted to take a minute and preserve some of the more exciting memories. Specifically, we wanted to summarize how the memory forensics field and Volatility community has progressed this year.

• Volatility 2.4 was released - our most stable and fully featured code base, supporting all of the major versions of Windows, Linux, and Mac. The release includes Windows 8 and Server 2012 support, despite the encrypted debugging structures. Windows 10 beta support is also available.
• We also moved to Github, which makes it easier for other developers to submit patches and pull requests. A separate repository stores Linux and Mac profiles. The 2.5 release is also under way. 
• Extraction of TrueCrypt cached passwords and master keys become even easier than it was before, with new plugins that execute a structured approach at locating and recovering the data. The capability was also ported to Linux, and a member of the community completed a similar plugin for dm-crypt.
• Our 5-day hands-on Malware and Memory Forensics training course proliferated to over 10 events (public and private) across the United States, Europe, and Australia. Testimonials from attendees are available here and registration is open for classes in 2015.
• The Volatility Foundation was established as a 501(c)(3) non-profit organization. A new website was created to aggregate the foundation's resources. Among other things, the site describes the various ways to get involved with the community. The Volatility(R) name also became a registered trademark of the Volatility Foundation.
• Volexity, LLC became a corporate sponsor of the Volatility Foundation and named core developer Michael Hale Ligh as its CTO. Volexity is a security firm based out of the Washington, D.C. area that specializes in assisting organizations with threat intelligence, incident response, forensics, and trusted security advisory.
• The Volatility Plugin Contest received an extremely generous donation from Facebook and generated an enormous amount of new capabilities from various talented developers and researchers. 
• The Volatility Team partnered with GMG Systems, Inc. to offer KnTTools (incl. KnTDD) at a discounted rate to students in our training course. KnTTools is the most reliable, robust, and fully featured memory acquisition suite for Windows. 
• Volatility and memory forensics were represented at almost all security and technology related conferences, including (but not limited to) Blackhat USA, Defcon, OMFW, OSDFC, API Cybersecurity, SecTor, Archc0n, Alabama Cyber Security Summit, National Cyber Crime Conference, RSA USA, BSides, and Recon.
• Volatility was used by Det. Michael Chaves to track down high profile ATM skimmers. It was used by European law enforcement to produce the primary source of evidence that put away a child sex offender for over 10 years. It was used by the United States Government on various occasions to investigate cases involving espionage, cyber terrorism, and major botnet rings.
• Volatility developer Andrew Case and Golden G. Richard III won best paper at DFRWS 2014 for In lieu of swap: Analyzing compressed RAM in Mac OS X and Linux.
• We enjoyed a record breaking number of attendees at Open Memory Forensics Workshop (OMFW) 2014 and a serious group of awesome talks. Later that week, Next Generation Memory Forensics was presented at OSDFC. 
• The Art of Memory Forensics was published in August, a 900-page book that covers Windows, Linux, and Mac topics in depth. To date, its the most thorough and illustrative written source of memory forensics knowledge. Please remember to check the errata page and also the sample memory images that are accompanied with lab questions and answers (free online download). 
• A Reddit Ask Me Anything (AMA) was conducted on Art of Memory Forensics. We appreciate all the great questions!  
• An entire chapter of Black Hat Python was devoted to using Volatility for offensive purposes during pentests (extracting password hashes, injecting code, etc). 
• We presented some Volatility capabilities at Blackhat Arsenal and later created a YouTube channel with recordings of the demos. There was also a book signing in the Blackhat bookstore, which was an exciting way for us to meet new Volatility users in person.

 Thanks to all who played a part! We look forward to an even more productive 2015!

Detective Michael Chaves Shares A Memory Forensics Success Story

Detective Michael Chaves from the Monroe CT Police Department shares the following story regarding his experiences with Memory Forensics, Volatility Training, KnTTools, and POS breaches. Michael was also recently quoted in Brian Krebs' article Card Wash: Card Breaches at Car Washes for the key role that he played in that investigation.

Shouts to Michael - keep up the great work!

Before attending this class I had a strong digital forensic background, but lacked an understanding of the "under the hood" workings of RAM and the stuff running in RAM.  I knew I was in for a challenge and boy did I get one.  I always had a desire to learn about memory analysis and I had some knowledge of what it contained, but it was the significant increase in POS breaches that I was investigating that I realized I needed this class sooner than later.

After taking this class in May of 2014 I began investigating a POS breach involving a local business chain.  The chain was a Common Point of Purchase for thousands of credit/debit that were compromised that lead to more than $100,000 in losses from fraudulent use. From the class, I learned of a new memory acquisition tool from GMG Systems, Inc. called " KnTTools".  I tested it out and found it to be an extremely reliable, fast and efficient program that has a very small footprint.  I used KnTTools to acquire numerous RAM dumps from several locations.

Now came the time to figure out what I had.  Going in blind, not knowing where to look or even what I was looking for was a daunting task.  Referring to my notes and the student handbook, I began to use Volatility to try and understand what I had.  I began to use plugins such as pslist, psxview, malfind, apihooks and connections and I started to get some information to look more into.  Understanding the PID/PPID relationship and what process should call another was very helpful.  Working with the business I learned what programs were legit and white listed them.  This was important to me since I did not know what programs and applications were supposed to be running on those computers.  I located three running processes that turned out to be malware.  I used dlllist, dlldump, procdump and dumpfiles to extract out the processes, files and dll's and ran strings on them.  From there I located great information including the POST/GET commands that show where the cards were going to... BINGO!

I located the same malware on ALL other RAM acquisitions.  Although I do not know exactly how the malware got onto the system or fully how it works, I located the necessary information I needed to proceed with my investigation. Without this class or the Volatility tool, I would never have been able to further my investigation.  Volatility is a game changer in memory forensics.  With more and more POS breaches being reported every day both on a local and national scale, responders need the ability to efficiently and effectively analyze the RAM where the malware attempts to run.... and hide.  But you can't hide from Volatility!

Heads Up! 2014 Volatility Plugin Contest Deadline Extended!

Good news folks. Due to a very exciting and unexpected development, we're extending the deadline for the 2014 Volatility Plugin Contest to October 1st, 2014.

This not only gives you an extra month to work on your plugins, but the reason for the extension (to be announced later this week) will directly impact the contest winners.

New Volatility 2.4 Cheet Sheet with Linux, Mac, and RTFM

Our Windows Malware and Memory Forensics Training class is intense and rigorous, because its designed to reflect real world investigations. When you have a limited amount of time and you're being pressured for reliable answers - every minute counts. Sometimes you just gotta cheat...and when you do, you might as well use an Official Volatility Memory Analysis Cheat Sheet!

The 2.4 Edition features an updated Windows page, all new Linux and Mac OS X pages, and an extremely handy RTFM-style insert for Windows memory forensics.

For in-depth examples and walk-throughs of using the commands in this cheat sheet, make sure to get your copy of The Art of Memory Forensics!

Presenting Volatility Foundation Volatility Framework 2.4

The release of this new Volatility version coincides with the publication of The Art of Memory Forensics. It adds support for Windows 8, 8.1, 2012, and 2012 R2 memory dumps, Mac OS X Mavericks (up to 10.9.4), and Linux kernels up to 3.16. New plugins include the ability to extract cached Truecrypt passphrases and master keys from Windows and Linux memory dumps, investigate Mac user activity (such as pulling their contact database, calendar items, PGP encrypted mails, OTR Adium chat messages, etc), and analyze advanced Linux rootkits. See below for a detailed change log.

Binary releases, including pre-built executables for Windows and Mac OS X can be found on the Volatility Foundation website: http://www.volatilityfoundation.org. We've also now moved our source code repository to Github: https://github.com/volatilityfoundation. Note that there's a separate repository containing over 160 Linux profiles for 32- and 64-bit OpenSuSE, Redhat, Debain, Ubuntu, Fedora, and CentOS (thanks Kevin!); and all Mac OS X profiles from 10.5 to 10.9.4. 

The detailed change log is below:

Windows Memory Forensics 

• Truecrypt plugins (summary, cached passphrases, master keys)
• Apihooks support for 64-bit memory images 
• Apihooks plugin detects JMP FAR hook instructions 
• Hashdump, Cachedump, and Lsadump plugins updated for x64 and Win8/2012
• Callbacks and timers plugins work on 64-bit memory images 
• Mftparser identifies NTFS alternate data streams 
• Mftparser -D option extracts MFT-resident files to disk
• Ability to scan for multiple executive object types concurrently with a single pass through the memory dump 
• Procmemdump and procexedump condensed into "procdump" (and --memory option available)
• Envars plugin has a --silent flag to ignore common/default environment variables 
• Vadtree plugin in graphviz output mode (--output=dot) color codes nodes per heap, stack, mapped file, DLL, etc.
• Getsids plugin automatically resolves user and service SIDs 
• Timeliner plugin supports --machine to identify the source in multi-source timelines 
• Verinfo (PE version info) plugin updated and moved into core framework 
• Strings translator prints "FREE MEMORY" for data found in deallocated regions (used to skip them)
• Vadinfo plugin allows --addr to specify one region rather than printing them all 
• Yarascan plugin allows you to control --size (bytes in preview) and --reverse (show data *before* a hit)
• Volshell plugin has new APIs proc(), addrspace(), getprocs(), and getmods() for easy access
• All process based plugins accept --name (process name regular expression filter)
• Added the auditpol plugin to check audit policies 
• Added the cmdline plugin to show process command line arguments 
• Volshell plugin can recursively print structure members (similar to windbg's dt /r)
• New pooltracker plugin allows analysis of kernel pool tag statistics 
• New bigpools plugin allows finding big page pool allocations 
• Svcscan plugin prints service start type (manual, automatic, disabled, etc)
• Added a plugin to find and print text on the Notepad application's heap
• PE dumping plugins (procdump, dlldump, moddump) support --fix to fix the image base value 
• Joblinks plugin for getting information for job objects

Address Spaces / File Formats

• Support for QEMU virtual machine memory images 
• Support for "split" VMware files (memory in .vmem and metadata in .vmss/.vmsn)
• Support for Windows BitMap crash dumps (created by Windows 8 / 2012 on BSOD)

Mac Memory Forensics 

• Support for Mavericks through 10.9.4
• Mac string translation added 
• Recover sent and received Adium messages, including those protected by OTR 
• Enumerate contacts from the Contact application's database
• Extract the HTML content of notes from the Notes application 
• Ability to reveal clear-text PGP emails sent or received with the Mail application 
• Locate Apple Keychain encryption keys in memory (for cracking with Chainbreaker)
• Find API hooks in both the kernel and process memory
• List IP and socket filters
• Extract loaded kernel extension to disk
• Find suspicious process mappings (i.e. injected code) 
• Find hidden kernel extensions
• Recovered files cached in memory

Linux Memory Forensics 

• Support for Linux kernels through 3.16
• Linux string translation added
• Detect API hooks in both userland processes and the kernel
• Detect GOT/PLT overwrites
• Find hollowed executables
• Find suspicious process mappings
• Library listing using the loader’s data structures
• Extract process ELF executables and libraries to disk
• List network interfaces in promiscuous mode
• List processes that are using raw sockets
• Find hidden kernel modules
• List Netfilter hooks
• Extract cached Truecrypt passphrases 

Art of Memory Forensics Picture Contest Winners!

If we were running a book picture contest, these would be the winners. Keep in mind, we actually do have a contest brewing where you can win large cash prizes and/or free training, Volatility swag, etc.

The following "retro cover" was submitted by Didier Stevens (@DidierStevens).

The following "I'm too sexy for my book" was submitted by Jonathan Zdziarski (@JZdziarski).

The following "white sangria and object headers" was submitted by Erika Noerenberg (@gutterchurl).

The following was submitted from The Disassembler (@Disassembler).

The following "don't leave home without it on ALL your devices" was submitted by Dennis York (@LDRydr). 

The following "third eye wide open" was submitted by Golden G. Richard (@nolaforensix).

The following "back from defcon" was submitted by Mariano Graziano (@emd3l). 

The following was submitted by Bob Dobalina (@northTtown) - not sure what this is, but it looks interesting. 

The following "part of the cannon" was submitted by Troy Larson. 

The following was submitted by Brian Moran (@brianjmoran).

The following "twins, almost" was submitted by by Andy Magnusson.

The following "Volatility, on the job" was submitted by Ken Pryor (@KDPryor). I thought I'd only see AMF in an officer's car if I got arrested while holding it!

The following "Vanity, thy name is @moyix" was submitted by Brendan Dolan-Gavitt (@moyix).

The following was submitted by Frankie Li (@Espionageware).

The following was submitted by Andrew Case (@attrc).

We'd love to see other readers in action with the book! Tweet them to @volatility to enter the contest (be aware, there are no prizes, except smiles).

Announcing Windows Malware and Memory Forensics in Austin, San Francisco, and Brazil!

Along with the release of The Art of Memory Forensics, we are very happy to announce that we now have the following new Malware and Memory Forensics trainings scheduled:

• Australia - August 25th - 29th, 2014 (nearly full)
• Reston - October 6th - 10th, 2014 (nearly full)
• Austin - December 8th - 12th, 2014 (NEW)
• San Francisco - January 12th - 16th, 2015 (NEW)
• Brazil - February 2nd - 6th, 2015 (NEW)

This is the only memory forensics course officially designed, sponsored, and taught by the Volatility developers. One of the main reasons we made Volatility open-source is to encourage and facilitate a deeper understanding of how memory analysis works, where the evidence originates, and how to interpret the data collected by the framework's extensive set of plugins. Now you can learn about these benefits first hand from the researchers and developers of the most powerful, flexible, and innovative memory forensics tool.

Instructors
Michael Ligh (@iMHLv2), Andrew Case (@attrc), and Jamie Levy (@gleeda)
Information on each instructor can be found here.

Registration Process
To request a link to the online registration site or to receive a detailed course agenda/outline, please send an email voltraining [[ at ]] memoryanalysis.net or contact us through our web form.

Past Reviews
Many past reviews of the course can be found on our website here as well as a previous blog post here. We also have some additional feedback from our recent courses:

"Wonderful and mind blowing course" - Lakshmi R., Incident Response 

"that was the best training week that I have spent in my entire career" - Sean M. 

"As relevant (if not more) than any disk based forensics course. Should be required for incident responders / digital forensics investigators" - Christian R., Senior Member of Technical Staff

"A top-notch and highly skilled team presents students with more vaulable information and insight than any other source of info - effectively using the premier memory analysis tool" - Matthew G. 

"This was the most in-depth forensic course I've ever taken. The instructors are top notch and really know the material and concepts behind it. If you're serious about protecting your network, you need to take this course." - Ryan G.

"This is the best forensics training I have ever participated in. You don't just learn what commands to blindly punch in; you gain deep insight into Windows internals, understand how malware can subvert the OS, and how to detect these abuses. Also tons of stuff I can bring home to continue training and apply to my work." - Christian B.

"I've done my share of courses; yours has it all: "wow" factor in class, great expectations, great labs." - Jorge C., IT Security Expert

Volatility at Black Hat USA & DFRWS 2014

Due to another year of open research and giving back to the open source community, Volatility will have a strong presence at both Black Hat USA and DFRWS 2014. This includes presentations, a book signing, and even a party!

At Black Hat, the core Volatility Developers (@4tphi, @attrc, @gleeda, @iMHLv2, and Mike Auty) will be partaking in a number of events including:

• Releasing Volatility 2.4 at Black Hat Arsenal: This release includes full support for Windows 8, 8.1, Server 2012, and Server 2012 R2, TrueCrypt key and password recovery modules, a switch to GitHub hosting, as well as over 30 new Mac and Linux plugins for investigating malicious code, rootkits, and user activity. 
• Releasing The Art of Memory Forensics: AMF is over 900 pages of memory forensics and malware analysis across Windows, Mac, and Linux. It will be available for the first time in the bookstore during the pre-conference trainings and briefings.
• Book Signing for AMF: On Wednesday, August 6th at 3:15PM, in the Black Hat book store, we will be on site for signing books. 
• Volatility Happy Hour sponsored by The Hacker Academy: This will be an open bar party where you can meet our team, bring books to be signed, and get stickers, t-shirts, and other Volatility swag all while enjoying tasty beverages. You must register (free) if you wish to attend!

Friends of Volatility will also be leading a number of events at Black Hat including Briefing presentations from Silvio Cesare and Andrew Hay and Arsenal demos from Joe Grand, Vico Marziale, Joe Sylve, David Cowen, and Jeff Bryner. 

At DFRWS, Dr. Golden Richard (@nolaforensix) will be presenting a paper that he and I wrote: In Lieu of Swap: Analyzing Compressed RAM in Mac OS X and Linux. In this paper, we discuss the in-memory, compressed swap facilities of Mac OS X and Linux, their impact on memory forensics investigations, and how we developed Volatility plugins to decompress the caches transparently during the operation of Mac & Linux analysis plugins. 

We hope to see everyone at these events, and we are looking forward to an exciting August! 

Volatility - Update All The Things

The Art of Memory Forensics

Our book is cleared for release at the Blackhat USA conference this August. You can preorder hard copies and Kindle editions on Amazon now. Huge thanks to our publisher, Wiley, for allowing us to exceed 900 pages after we initially estimated 650...without raising the price of the book.

Malware and Memory Forensics Training

Corey Harrell (@corey_harrell) shared a few words about his recent experience in our training class on his blog (not to mention a really nice analysis of using timelines to analyze malware infections). 

The training is not just about a single memory forensics tool named Volatility. The training goes in-depth in numerous topics including Windows internals, malware reversing, Windows data structures, how those structures are parsed, and bypassing encryption. I was looking for an in-depth course and I found it with Volatility. It walks you through exploring the Windows internals, the structures, how they can be parsed, and then actually doing it in labs. This layout results in knowing not just how to use tools for memory forensics but understanding what they are doing and what they are suppose to be doing. To top it off, the content is put into context as it relates to Digital Forensics and Incident Response (DFIR). All in all, it was a great training and  I highly recommend it to anyone looking to get more memory forensics knowledge and skills.

To see what other people think about the class, see our testimonial page. Upcoming training events include:

• June 9th - 13th, London, UK
• October 6th - 10th, Reston, Virginia 
• August 25th - 29th, Canberra, Australia 
• December 8th - 12th, Austin, Texas

Contact us at voltraining [at] memoryanalysis.net or leave a note on the web form for information on how to register.

KnTTools / KnTDD Memory Acquisition 

We've partnered with GMG Systems, Inc. to promote what we believe is the most reliable, robust, and full featured memory acquisition software available. A few important notes accompany this announcement:

• This offer applies to those who participate in our training course. If you are not an alumni or currently registered for an upcoming class, please contact GMG Systems, Inc. directly.
• You must supply either an X.509 certificate or PGP key for encrypted delivery of the software. 
• GMG Systems, Inc. reserves the right to refuse orders. 

Once we get KnTTools into the hands of more investigators, we're confident the number of "HELP, my memory dump is corrupt!" situations will decrease. If you know what we mean, its probably time you start using KnTTools. 

The Volatility Foundation 

We've launched a new website for The Volatility Foundation, an independent 501(c) (3) (pending) non-profit organization that maintains and promotes open source memory forensics with The Volatility Framework.

2014 Volatility Plugin Contest 

The contest has begun! You can find official rules and documentation on the contest's homepage. This is the 2nd annual contest where you get to show off your creativity and design skills, win cash prizes, and contribute to open source memory forensics software (while retaining all rights to your code). Submissions are due no later than September 1, 2014.

Volatility 2.4 Release Coming Up

If you've been looking forward to the next Volatility release, you're not alone! We've been working on the 2.4 code base and we expect it to be available on or before the date our books starts shipping. There are 30-40 (lost count at this point) new plugins just for Linux and Mac, not to mention some really awesome new capabilities for Windows. In fact, just yesterday we added the ability to extract cached Truecrypt passphrases from Linux memory dumps.

$ python vol.py --profile=LinuxUbuntux86 

        -f memory.lime 

        linux_truecrypt_passphrase

Volatility Foundation Volatility Framework 2.4 (Beta)

Process          Pid      Address    Password

---------------- -------- ---------- --------

truecrypt            5724 0x09277a24 password123

truecrypt            5724 0x092c4b4c password456

The Art of Memory Forensics

By now, some of you may have realized that The Art of Memory Forensics is available for pre-order on Amazon.

The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory

This book is written by 4 of the core Volatility developers - Michael Ligh (@iMHLv2), Andrew Case (@attrc), Jamie Levy (@gleeda) and AAron Walters (@4tphi). We've been collaborating for well over 6 years to design the most advanced memory analysis framework and we're excited to be collaborating on a book.

The content for the book is based on our Windows Malware and Memory Forensics Training class, which has been executed in front of hundreds of students across the US and Europe. As an added bonus, the book will also cover Linux and Mac memory forensics.

Unlike some other books, which will run you $50 for 250 pages (we call those expensive brochures), The Art of Memory Forensics will be over 700 pages. In fact, its still possible that we may grossly exceed that and have to split it into two editions, which will royally piss off our publisher.

An electronic book will be available for Kindle initially and at some point, also on Safari Bookstore.