Home

Awesome

<img src="https://github.com/JamesHabben/evolve/blob/master/images/evolve-logo.png" /> <br /> Web interface for the Volatility Memory Forensics Framework https://github.com/volatilityfoundation/volatility

Current Version: 1.6 (2017-11-16) <br /><br /> See what people are saying: #EvolveTool <br /> Short video demo: https://youtu.be/55G2oGPQHF8 <br /> Pre-Scan video: https://youtu.be/mqMuQQowqMI

Installation

This requires volatility to be a library, not just an EXE file sitting somewhere. Run these commands at python shell:

Download Volatility source zip from https://github.com/volatilityfoundation/volatility<br /> Inside the extracted folder run: <br /> setup.py install<br />

Then install these dependencies: <br /> pip install bottle <br /> pip install yara <br/ > pip install distorm3 <br/ > pip install maxminddb <br/ >

Usage

-f File containing the RAM dump to analyze <br /> -p Volatility profile to use during analysis (--profile may not work even though it shows as an option) <br /> -d Optional path for output file. Default is beside memory image <br /> -l Restrict web server from serving content outside of the local machine <br /> -r comma separated list of plugins to run at the start<br />

!!! WARNING: Avoid writing sqlite to NFS shares. They can lock or get corrupt. If you must, try mounting share with 'nolock' option.

<img src="https://github.com/JamesHabben/evolve/blob/master/images/evolve-cmd.png" />

Features

Coming Features

Please send your ideas for features!

<img src="https://github.com/JamesHabben/evolve/blob/master/images/evolve-connections.png" /> <br /><br /> <img src="https://github.com/JamesHabben/evolve/blob/master/images/evolve-wsock32.png" />

Release notes:<br /> v1.0 - Initial release <br /> v1.1 - Threading, Output folder option, removed unused imports<br /> v1.2 - Pre-Scan option to run list of plugins at the start<br /> v1.3 - Added Morph function and sample Morphs. Also fixed multiprocess bug in Windows.<br /> v1.4 - Added Morph config builder and more sample Morphs. Added searchable and sortable table.<br /> v1.5 - Added dynamic memory profile chooser.<br /> v1.6 - Added plugin search and other optimizations.<br />