### Volatility semi-automated memory image processing, for WinXP images
### bsk for dfirnotes.org, Copyleft MIT License : https://github.com/DFIRnotes/rules/blob/master/LICENSE
### Requirements: SIFT 3 or volatility 2.5.x ; pictures needs PIL and dot available
### Run volatility framework anlaysis plugins against a provided image in an opinionated order
###     0) Quick pass to list processes and connections, 1)long run of many plugins with simple args,
###     2) long run of complex plugins; 3)make pictures
### Ref: FOR508, Art of Memory Forensics, Malware Analyst Cookbook

### TODO
## BUGFIX: Set out location to . if env var not set
## FEATURE: document how to branch -2
## FEATURE: Pull volatility version rather than static string
## FEATURE: if file exists and is greater than sizeof(vol usage error), skip the plugin ?
## FEATURE: tidy malsysproc extra linefeeds ?
## WISHLIST: find a way to use the ssdeep, baseline community plugins
## WISHLIST perf : Specify kdbg offset?
## WISHLIST: duplicate image file to run plugins in parallel for faster results / test this more
## WISHLIST: port to BAT for Windows or BETTER python for crossplatform
###

adric@marie:/cases/DFIRNETWARS/xp-tdungan-memory⟫ VOL_FILEIN=xp-tdungan-memory-raw.001 OUT_FOLDER=. bash vol-xp.sh
***Volatility batch*** using Volatility Foundation Volatility Framework 2.5 + Community plugins on Linux
***Volatility batch*** 0) First, quick tables upfront to look for interesting processes: pstree malsysproc connections sockets
***Volatility batch*** 0)Quick tables completed. 1)Starting batch plugin processing ...
 apihooks,  autoruns,  callbacks,  connections,  connscan,  cmdline,  cmdscan,  clipboard,  consoles,  dlllist,  driverirp,  drivermodule,  driverscan,  getsids,  iehistory,  handles,  hivelist,  hivescan,  imageinfo,  ldrmodules,  malfind,  malprocfind,  modscan,  modules,  psscan,  psxview,  schtasks, shellbags,  sockscan,
***Volatility batch*** 1) Batch processing, simple plugin arguments done
***Volatility batch*** 2) Starting complex plugins: pstotal DOT, eventlogs, svcscan V, mutantscan N, mftparser BODY, and timeliner
3) Make pictures!
Wrote ./session_0.Service-0x0-3e5$.Default.png
Wrote ./session_0.SAWinSta.SADesktop.png
Wrote ./session_0.Service-0x0-3e7$.Default.png
Wrote ./session_0.Service-0x0-3e4$.Default.png
Wrote ./session_3.WinSta0.Default.png
Wrote ./session_3.WinSta0.Disconnect.png
Wrote ./session_3.WinSta0.Winlogon.png
Wrote ./session_0.WinSta0.Default.png
Wrote ./session_0.WinSta0.Disconnect.png
Wrote ./session_0.WinSta0.Winlogon.png
***Volatility batch*** Volatility batch run on xp-tdungan-memory-raw.001 completed!