Volatility

Walkthrough summary

Volatility TryHackMe walkthrough with 16 answered prompts and lab methodology notes.

Sample prompts covered

• What is the build version of the host machine in Case 001?
  Open the walkthrough page to inspect the full answer and command flow.
• At what time was the memory file acquired in Case 001?
  Open the walkthrough page to inspect the full answer and command flow.
• What process can be considered suspicious in Case 001?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the parent process of the suspicious process in Case 001?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the PID of the suspicious process in Case 001?
  Open the walkthrough page to inspect the full answer and command flow.