Forensics
Volatility is an advanced open-source memory forensics framework used for incident response and malware analysis, allowing extraction of digital artifacts from volatile memory (RAM) samples.
sudo apt install volatility
volatility -f <memory_dump> <plugin>
Volatility is the world's most widely used memory forensics framework. It extracts digital artifacts from volatile memory (RAM) dumps, revealing running processes, network connections, registry data, and injected malware that disappear when a system is powered off.
Developed by the Volatility Foundation and originally based on the Rekall project from Google, Volatility supports Windows, Linux, Mac, and Android memory images through a comprehensive plugin architecture.
Volatility 3, the latest major release, is a complete rewrite in Python 3 with improved performance, modernized plugin interfaces, and support for newer operating systems. It remains the gold standard for incident response memory analysis.
vol -f /path/to/file windows.infoVolatility 3: identify OS build and kernel details of a memory imagevol -f /path/to/file windows.pslistVolatility 3: list running processes from the EPROCESS listvol -f /path/to/file windows.pstreeVolatility 3: show processes as a parent/child treevol -f /path/to/file windows.psscanVolatility 3: scan for processes including hidden/terminated onesvol -f /path/to/file windows.cmdlineVolatility 3: show command-line arguments for each processvol -f /path/to/file windows.dlllistVolatility 3: list DLLs loaded by each processvol -f /path/to/file windows.handles --pid 1234Volatility 3: list handles held by a processvol -f /path/to/file windows.netscanVolatility 3: recover network connections and listening socketsvol -f /path/to/file windows.netstatVolatility 3: list network connections with owning processesvol -f /path/to/file windows.malfindVolatility 3: find injected code and suspicious memory regionsvol -f /path/to/file windows.svcscanVolatility 3: enumerate Windows servicesvol -f /path/to/file windows.hashdumpVolatility 3: dump cached local account password hashesvol -f /path/to/file windows.filescanVolatility 3: scan for FILE_OBJECT structures to enumerate filesvol -f /path/to/file windows.dumpfiles --pid 1234Volatility 3: extract cached files for a given processvol -f /path/to/file windows.registry.hivelistVolatility 3: list registry hives present in memoryIdentify fileless malware, injected code, and hollowed processes that evade traditional antivirus solutions.
List all running and terminated processes to identify suspicious activity and unauthorized software.
Recover network connections, socket states, and DNS cache from memory to trace communication patterns.
Extract Windows registry hives from memory to recover user activity, installed software, and system configuration.
Dump password hashes, Kerberos tickets, and cached credentials from memory for authentication analysis.
Detect hidden processes, hooked APIs, and kernel-level rootkits through memory integrity checks.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.