PassMark Volatility Workbench

Designed as a frontend for the console volatility app created by PassMark, the PassMark Volatility Workbench delivers a forensics application that can read memory dump files and extract artifacts from them.

Released under an open-source license, this application is compatible with BIN, RAW, DMP or MEM files, allowing you to explore their contents and save the data to your PC.

Unlike its console-based counterpart, the PassMark Volatility Workbench brings to the table additional pluses that make it worth your while. First of all, the GUI edition does not need you to install additional software as a requirement and, obviously, does not need you to remember command line parameters.

To begin, you need to browse for the memory dump file you want to use as input. One you do so, the application automatically detects your platform. You can start refreshing the process list as loaded in the memory file and the lower-side panel gets populated with the PID, PPID, the image file name, offsets, number of threads, handles and session IDs. The creation time and the exit time are also displayed.

The next step is to select the command you want to execute from the designated drop-down menu. If you require extra details and explanations, you can hit the “Command info” button and usage instructions are shown in an instant.   The output of the executed commands can be easily saved to file or copied to the clipboard with the click of a button.