> For the complete documentation index, see [llms.txt](https://dika-maulidal.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dika-maulidal.gitbook.io/home/writeups-and-walkthroughs/tryhackme-thm/volatility-essentials.md).
# Volatility Essentials
Learn how to perform memory forensics with Volatility!
{% embed url="" %}
## Task 3: Memory Acquisition and Analysis
**3.1** What is the build version of the host machine in Case 001?
```bash
python3 vol.py -f ../Investigations/Investigation-1.vmem windows.info
```
Kita bisa melihatnya di `NTBuildLab`.
```
Jawaban: 2600.xpsp.080413-2111
```
**3.2** At what time was the memory file acquired in Case 001?
```bash
python3 vol.py -f ../Investigations/Investigation-1.vmem windows.info
```
Kita bisa lihat pada bagian SystemTime
```
Jawaban: 2012-07-22 02:45:08
```
## Task 4: Listing Processes and Connections
**4.1** What is the absolute path to the active Adobe process?
```bash
python3 vol.py -f ../Investigations/Investigation-1.vmem windows.pstree | grep -i adobe
```
```
Jawaban: C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
```
**4.2** What is the parent process of this process in Case 001?
```
Jawaban: explorer.exe
```
**4.3** What is the PID of the parent process?
```
Jawaban: 1484
```
**4.4** How many DLL files are used by the Adobe process that are outside the `system32` directory?
```bash
python3 vol.py -f ../Investigations/Investigation-1.vmem windows.dllist --pid 1484 | grep -v -i system32
```
```
Jawaban: 3
```
**4.5** What is the name of the one KeyedEvent associated with the process's handles?
```bash
python3 vol.py -f ../Investigations/Investigation-1.vmem windows.handles --pid 1484 | grep -i keyedevent
```
```
Jawaban: CritSecOutOfMemoryEvent
```
## Task 5: Volatility Hunting and Detection Capabilities
**5.1** What processes in the Case 001 memory file contain a header that points to a Windows executable file? (Answer: process1,process2)
```bash
python3 vol.py -f ../Investigations/Investigation-1.vmem windows.malfind | grep -i "MZ Header"
```
```
Jawaban: explorer.exe,reader_sl.exe
```
## Task 6: Advanced Memory Forensics
6.1 What is the address for the `NtCreateFile` system call?
```bash
python3 vol.py -f ../Investigations/Investigation-1.vmem windows.ssdt
```
```
Jawaban: 0x8056e27c
```
***
