Forum Discussion

CapsLockSingh's avatar
CapsLockSingh
Icon for Bronze I rankBronze I
2 months ago

Help in Volatility Memory Analysis: Ep.2 – Processes and DLLs

Hello everyone, I started with Volatility memory analysis and am stuck in question 13 on SID It ask for first SID that is returned which in this case seems to be "S-1-5-18" (Maybe I am wrong here...
defensive cyber
AbdelrhamnaAttia's avatar
AbdelrhamnaAttia
Icon for Bronze II rankBronze II
2 months ago

Hello,
I fully concur with MarcioMota; it's essential to always include a "-" before any option you use. A resource I always rely on in my real-life DFIR work is this cheat sheet. It's very supportive and will help you immensely in both this CTF and real-world situations: https://downloads.volatilityfoundation.org/releases/2.4/CheatSheet_v2.4.pdf