Clipboard analysis and forensics

[Tokeii0]

Is there a way to access the contents of the clipboard, similar to the Clipboard command in Volatility 2?
For instance, Windows 11 seems to cache some content in C:\Users{username}\AppData\Local\Microsoft\Windows\Clipboard.
I'm just curious if it's possible. I noticed Volatility 3 hasn't added this feature yet.

[ufrisk]

MemProcFS is sometimes able to recover recently open files if running in Forensics mode, you'll find these under M:\forensic\files\ROOT\

About the clipboard it's something I have to look into and research. Right now I'm a bit busy on working on some other new features and also fixes in other areas so it may be that there will be some time before I'm able to look into it.

[tmechen]

I stumbled across this feature again because Volatility 3 still hasn't implemented it, and unfortunately, MemProcFS hasn't either. I've included the Volatility 2 implementation,wiki entry and their blog post with additional information below for future reference:

https://github.com/volatilityfoundation/volatility/blob/master/volatility/plugins/gui/clipboard.py
https://github.com/volatilityfoundation/volatility/wiki/Command-Reference-Gui#clipboard
https://volatility-labs.blogspot.com/2012/09/movp-34-recovering-tagclipdata-whats-in.html

[ufrisk]

I'm aware that of the Volatility2 plugin for clipboard recovery. The main issue is that it's quite old and does not work on more recent Windows versions.

For MemProcFS, I've made the decision if I'm adding new features I want them to work on the most recent versions of Windows. I don't see much point in adding stuff that will only work on Windows XP and Windows 7. Note that I don't really have an issue in supporting older OS'es as well, but then it should be for features working on modern Windows versions as well.

This is a quite interesting area and it clearly requires more research. It ought to be possible I think, at least for some clipboard types. I'll put this up as en enhancement suggestion. I don't know when/if I'll have time to look into it though, but maybe someone is interested in doing a bit of research around this ;)