Ok, so we need to mount a raw image to be able to extract some files from it. Prior to doing this, we need to do a few things. Run the file command, to identify how many partitions are within…
One of the main challenges when using new tools is knowing what the output is going to look like once you’re done. Does it present itself in a visually appealing way, does it contain what you need, etc. As part…
Ok I’m still awake, so I figured that sharing some basic Volatility Syntax as the next post would be worthwhile. Memory forensics is a valuable way to acquire more evidence from the system. The sooner the acquisition occurs, the better.…