Memory Forensics with Volatility | Searching For Encrypted Files | HackTheBox TrueSecrets

We covered conducting memory forensics using Volatility framework. The scenario involved a memory dump file that assumingly contained encrypted documents which we extracted with the relevant plugins such as filescan and dumpfiles. The extracted file was encrypted using TrueCrypt and therefore the password used for encryption was extracted using truecryptpassphrase plugin with Volatility version 2. The encrypted file was mounted as a filesystem after decryption with VeraCrypt and contained a source code written in C#. The source code contained snippets …

computerforensics documents encrypted encryption file files forensics framework hackthebox memory memory forensics password plugins relevant scenario truecrypt volatility