When using Volatility with a memory image, what is the Kernel version?

The Volatility memory forensics framework github website lists these Mac profiles for OS 10.11:

Profiles
--------
MacElCapitan_10_11_15A284x64            - A Profile for Mac ElCapitan_10.11_15A284 x64
MacElCapitan_10_11_1_15B42x64           - A Profile for Mac ElCapitan_10.11.1_15B42 x64
MacElCapitan_10_11_2_15C50x64           - A Profile for Mac ElCapitan_10.11.2_15C50 x64
MacElCapitan_10_11_3_15D21_15D13bx64    - A Profile for Mac ElCapitan_10.11.3_15D21_15D13b x64
MacElCapitan_10_11_4_15E27ex64          - A Profile for Mac ElCapitan_10.11.4_15E27e x64
MacElCapitan_10_11_4_15E39dx64          - A Profile for Mac ElCapitan_10.11.4_15E39d x64
MacElCapitan_10_11_4_15E49ax64          - A Profile for Mac ElCapitan_10.11.4_15E49a x64
MacElCapitan_10_11_4_15E65x64           - A Profile for Mac ElCapitan_10.11.4_15E65 x64
MacElCapitan_10_11_5_15F18b_15F24bx64   - A Profile for Mac ElCapitan_10.11.5_15F18b_15F24b x64
MacElCapitan_10_11_5_15F34x64           - A Profile for Mac ElCapitan_10.11.5_15F34 x64
MacElCapitan_10_11_6_15G1004_15G1108x64 - A Profile for Mac ElCapitan_10.11.6_15G1004_15G1108 x64
MacElCapitan_10_11_6_15G1212x64         - A Profile for Mac ElCapitan_10.11.6_15G1212 x64
MacElCapitan_10_11_6_15G1217x64         - A Profile for Mac ElCapitan_10.11.6_15G1217 x64
MacElCapitan_10_11_6_15G12ax64          - A Profile for Mac ElCapitan_10.11.6_15G12a x64
MacElCapitan_10_11_6_15G1421x64         - A Profile for Mac ElCapitan_10.11.6_15G1421 x64
MacElCapitan_10_11_6_15G1510x64         - A Profile for Mac ElCapitan_10.11.6_15G1510 x64
MacElCapitan_10_11_6_15G1611x64         - A Profile for Mac ElCapitan_10.11.6_15G1611 x64
MacElCapitan_10_11_6_15G17023x64        - A Profile for Mac ElCapitan_10.11.6_15G17023 x64
MacElCapitan_10_11_6_15G18013x64        - A Profile for Mac ElCapitan_10.11.6_15G18013 x64
MacElCapitan_10_11_6_15G19009x64        - A Profile for Mac ElCapitan_10.11.6_15G19009 x64
MacElCapitan_10_11_6_15G19ax64          - A Profile for Mac ElCapitan_10.11.6_15G19a x64
MacElCapitan_10_11_6_15G20015x64        - A Profile for Mac ElCapitan_10.11.6_15G20015 x64
MacElCapitan_10_11_6_15G24b_15G31x64    - A Profile for Mac ElCapitan_10.11.6_15G24b_15G31 x64
MacElCapitan_10_11_6_15G7ax64           - A Profile for Mac ElCapitan_10.11.6_15G7a x64

The Mac I am trying to analyze has this About box:

Here is the uname output:

users-Mac:~ user$ uname -a
Darwin users-Mac.local 15.6.0 Darwin Kernel Version 15.6.0: Thu Jun 23 18:25:34 PDT 2016; root:xnu-3248.60.10~1/RELEASE_X86_64 x86_64
users-Mac:~ user$ 

I have tried all of the Volatility profiles and none of them work.

What does the string in the volatility profile after the 10_11_6_ mean, and how do I find it for my machine?

Solution 1:

That string is the macOS build number. If you click on "10.11.6" in the About-box in your screenshot, it will be revealed right next to the version number.

You can also run sw_vers to get easy build / version / marketing information from the command line.