[How To] Volatility Memory Analysis Building Linux Kernel Profiles

Memory foreniscs in Linux is not very easy. The reason is because the Linux kernel changes data structures and debug symbols often. Users can also easily modify and compile their own custom kernels. If we want to analize Linux memory using Volatility, we have to find or create linux profiles for the version of Linux that we are trying to analize. Linux profile creation for Volatility is not that difficult. The documentation claims that Volatility will support profile sharing in the future, which should make Linux support much easier.

For now, we still have to make our own profiles. Please see the video below for details. We used LiME for Linux memory acquisition.