Friday 17 April 2015

Evolve: Python Based Web Interface For Memory Forensics Framework Volatility

Evolve: Python Based Web Interface For Memory Forensics Framework Volatility.


This requires volatility to be a library, not just an EXE file sitting somewhere.
Run these commands at python shell:

pip install volatility 
pip install yara 
pip install distorm3 

Note: you may need to prefix 'sudo' on the above commands depending on your OS.


-f File containing the RAM dump to analyze 
-p Volatility profile to use during analysis 


  • Works with any Volatility module that provides a SQLite render method (some don't)
  • Automatically detects plugins - If volatility sees the plugin, so will eVOLve
  • All results stored in a single SQLite db stored beside the RAM dump
  • Web interface is fully AJAX using jQuery & JSON to pass requests and responses
  • Uses Bottle module in Python to provide a standalone web server
  • Option to edit SQL query to provide enhanced data views with data from multiple tables
  • Run plugins and view data from any browser - even a tablet!
  • Allow multiple people to review results of single RAM dump

Coming Features

  • Save custom queries for future use
  • Import/Export queries to share with others
  • Threading for more responsive interface while modules are running
  • Export/save of table data to JSON, CSV, etc
  • Review mode which requires only the generated SQLite file for better portability



Post a Comment

Note: only a member of this blog may post a comment.

Toggle Footer