Awesome

DFRWS-USA-2023

This repository contains the version information and plugins to reproduce the results from the research paper "Windows memory forensics: Identification of (malicious) modifications in memory-mapped image files" (see here). These plugins will hence not be updated, so:

NOTE: For the most current version of all plugins contained in here, see: https://github.com/f-block/volatility-plugins.

Software Versions used in the Research

Windows versions used for research and tested with these plugins:

• Windows 10 22h2 Build 19045
• Windows 10 21h1 Build 19043
• Windows 10 1511 Build 10586

Specific Windows versions for particular tests are also mentioned in the paper.