volatility uses the concept of profiles to determine how to apply necessary signatures and offsets to pluck information out of memory dumps but if you can retrieve memory image from target via firewire or remotelyyou might not necessarily know the exact version of the operating system you're attacking thankfullyvolatility includes plugin called imageinfo that attempts to determine which profile you should use against the target you can run the plugin like sopython vol py imageinfo - "memorydump imgafter you run ityou should get good chunk of information back the most important line is the suggested profiles linewhich should look something like thissuggested profile(swinxpsp winxpsp when you're performing the next few exercises on targetyou should set the command-line flag -profile to the appropriate value shownstarting with the first one listed in the above scenariowe' usepython vol py plugin --profile="winxpsp arguments you'll know if you set the wrong profile because none of the plugins will function properlyor volatility will throw errors indicating that it couldn' find suitable address mapping