Volatility Plugins

Feel free to test and give feedback

keyring

• Dumps the content of the kernel keyring including the payload of all keys regardless of key permissions
• Can be used to dump LUKS encryption keys and other cryptographic secrets
• Tested on Debian and Ubuntu VMs
• The output format is similar to cat /proc/keys

Usage:

vol -p volatility3_plugins/ -f memory_dump linux.keyring.Keyring
# or dump to csv
vol -p volatility3_plugins/ -f memory_dump -r csv linux.keyring.Keyring > keyring.csv

See example/ubuntu2604_keyring.csv for a sample output