Volatility Command : Using IMAGEINFO to find type of System Image

1.   After installing Volatility as I gave details in my post here,next we need to start exploiting the power of Volatility.In my next posts ahead I would decipher usage of the general commands used for Volatility.To start with I initiate with IMAGEINFO command whose output tells the suggested profile that you should pass as the parameter to --profile=PROFILE; there may be more than one profile suggestion if profiles are closely related. One can figure out which one is more appropriate by checking the "Image Type" field, which is blank for Service Pack 0 and filled in for other Service Packs.

2.  Next few screen-shots show how I have taken the RAM dump of Windows 7 OS with the help of DUMPIT utility that I downloaded from here.Dumpit vastly simplifies memory acquisition. Effectively Dumpit combines win32dd and win64dd into one tool and is so simple to use even a non-technical user could do acquisition from a USB key. The dump can then be analyzed using VOLATILITY.

3.   Firstly,I show u the windows screen here with the Dumpit file on desktop which I simply click one to get the dump.

 I get the following screen and I click YES

 Further yes to the command prompt screen starts the dump download as seen below :

 I get a success message here and the dump is ready for analysis.

 The .raw file that is generated,I move it to ubuntu for analysis which has Volatility installed.At the terminal I type the command as :

python vol.py -f file_name.raw imageinfo

and in a few minutes I get the profile suggested as Win7SP0x86 / Win7SP1x86