Determining what profile to use when analyzing Windows memory in Volatility

No need to guess or experiment with different profiles, let Volatility figure that out for you. In testing, this worked with all formats that Volatility supports. If you were the one to do the memory dump or if the file was labeled OS information, this wouldn’t be a concern or a needed step. To let the magic happen, follow the below.

This analyzes the memory capture metadata and displays which profile is suggested to be used.

The output will be something similiar to this:

From the above example, you see it suggests four different ones to use. I always go with the first one and usually don’t have a problem. If there is no suggestion, it is because the profile doesn’t exist and may require you to build a profile based on the kernel of the system the memory capture came from.

Next, we will be using the following syntax to run the profile with the memory capture. At the end of the syntax, I used ‘info’ to display all the plugins and scanners that can be used.