Volatility
Digital Forensics 6 commands

Volatility

Advanced memory forensics framework for incident response and malware analysis. Extracts digital artifacts from volatile memory (RAM).

forensicsmemoryincident-responseanalysis
Official docs

Installation

pip install volatility3
# or clone from github.com/volatilityfoundation/volatility3

Commands & usage

6 entries
  • vol -f <dump> windows.info

    System information

  • vol -f <dump> windows.pslist

    List processes

  • vol -f <dump> windows.netscan

    Network connections

  • vol -f <dump> windows.filescan

    Scan for file objects

  • vol -f <dump> windows.registry.hivelist

    List registry hives

  • vol -f <dump> windows.cmdline

    Process command line args

Use cases

Memory forensicsMalware analysisIncident responseRootkit detectionEvidence extraction