Tools · Forensics tools · 08 / 25
Volatility 3: connections still sitting in memory
windows.netscan lists network objects the kernel still has in the snapshot. You get addresses, ports, state, and an owner when the structure still points at one. You do not get the payload.
A row is an endpoint pair, plus a state
windows.netscan scans for connection structures and prints protocol, local address, local port, remote address, remote port, state, and the owning pid when it can. TCP rows often have a state such as ESTABLISHED, LISTENING, or TIME_WAIT. UDP rows may have a local endpoint and no remote peer, because UDP is not a session in the way TCP is. A listening row means something had a socket open for inbound connections. It does not, by itself, mean anyone connected.
The owner field is the link back to the process lesson. A connection owned by pid 4812 is the powershell object you already described, if that pid is the same object and not a later reuse. Check the process create and exit times against the acquisition. A connection row with a pid you cannot find in either process plugin is a row you keep, labeled “owner pid not present in pslist or psscan.” The address is still an artifact.
vol -f NL-FIN-14.raw windows.netscan
The table is one moment, and it remembers a little
The image was taken at 09:22 America/New_York, about two minutes after the shell exited. A connection that closed at 09:19 can still appear in TIME_WAIT; that state is short, and it would be gone by the afternoon disk image. A connection that is ESTABLISHED at acquisition is open at that moment, which is still after the file copy. You can say what the snapshot shows. You can say it is consistent with a destination you also see in Sysmon. You cannot stretch one ESTABLISHED row backward and claim it was the 09:18 session unless another artifact ties the same owner, the same remote address, and the same window.
Closed states are easy to overread. TIME_WAIT means the stack recently finished a TCP conversation and is holding the tuple so old packets do not confuse a new one. It supports “this pair was used recently, from the stack’s point of view,” and the stack’s “recently” is minutes, not a calendar. Put the state in the sentence.
Addresses are in the row, and the bytes are not
netscan does not reconstruct a file transfer. There is no HTTP body, no TLS transcript, and no workbook in the row. If the remote address is 203.0.113.44 and the remote port is 443, you have a destination and a port. TLS on 443 means the payload would have been encrypted even in a packet capture, and you do not have a packet capture in this plugin. The disk has the Temp file. The process command line may name the file. The network row names a peer. The combination is a lead that the peer was contacted by that owner. The contents of the conversation are a different exhibit you do not have yet.
Private addresses and loopback need a plainer reading. A row to 127.0.0.1 is the host talking to itself. A row to a 10. or 192.168. address is a local network peer, and you compare it to the office ranges Northline gave you. A public documentation address like 203.0.113.44 is, in this lab, the stand-in the scenario uses for the unfamiliar host. In a real case you would check who announces that address, under the authorization you have, and you would record the source of that check. You do not browse the internet from the examiner machine in a way that mixes your own traffic with the evidence.
Write a row the disk exam can use
Save the plugin output. In the case note, copy the few rows you can tie to the pid or the address you already care about. Each copied row includes protocol, local and remote endpoints, state, pid, and the process name if you resolved it. Add one line of context: “snapshot 09:22 America/New_York, after the 09:18 file create.” That line stops a reader from treating the table as the whole morning.
Then point at the other tools. Sysmon Event ID 3, if the config recorded it, is the log that was written at the time of the connection and can cover 09:18 even though RAM was copied later. DNS questions, Event ID 22, explain how a name became an address. Autopsy tells you whether the file named in the command line is the workbook hash. netscan is the memory side of that triangle.
Worked case: a closing row to the lab address
windows.netscan shows a TCP row, local 10.0.8.14:49822, remote 203.0.113.44:443, state TIME_WAIT, pid 4812. The process plugins already describe pid 4812 as the exited powershell.exe whose command line names both workbook paths. You record the row with the state and the acquisition time. You do not write that the workbook bytes were observed on the wire.
A second row is explorer.exe listening on a loopback port the desktop uses. You leave it in the saved output and out of the finding. The finding’s network sentence is one tuple, one owner, one state, and a pointer to the Sysmon export for any Event ID 3 or 22 in the 09:12–09:20 window that names the same remote address.
Diagram
From a netscan row to a sourced sentence
- Endpoints
Copy protocol, local address and port, remote address and port, and the state exactly as the plugin printed them.
- Owner
Resolve the pid in pslist or psscan. If the pid is missing, say so. Watch for pid reuse across times.
- Clock
Put the acquisition time on the sentence. A leftover state is about the snapshot, not the whole morning.
- Elsewhere
Ask Sysmon and the disk for the same remote address and the same file path. The payload is not in this table.
TCP 10.0.8.14:49822 -> 203.0.113.44:443 State: TIME_WAIT Owner: pid 4812 (powershell.exe, psscan) Snapshot: 09:22 America/New_York
Check yourself
1. A netscan row shows pid 4812, remote 203.0.113.44:443, state TIME_WAIT. The memory image was taken after the process exited. What can you say from this row?