Volatility

What is Volatility?

Volatility is the go-to open-source framework for memory (RAM) forensics. Starting from a memory dump, a file holding a copy of a machine's RAM at a given moment, it lets you reconstruct what was happening on that system: which processes were running, which network connections were open, which commands had been typed, which DLLs were loaded or what code had been injected into other processes. It is maintained by the Volatility Foundation and written in Python.

There are two generations. Volatility 2 ran on Python 2 and required you to specify an operating system profile (--profile=...). Volatility 3 is a full Python 3 rewrite that replaces profiles with symbol tables, detects the system automatically and groups plugins by platform: windows.*, linux.* and mac.*. This guide focuses on Volatility 3, which is the version worth learning today.

What Volatility is used for

• Incident response: spotting fileless malware that lives only in memory and leaves nothing on disk.
• Malware analysis: finding suspicious processes, injected code and connections to command-and-control servers.
• Forensic investigations: reconstructing what a user or attacker was doing at a specific point in time.
• Threat hunting: looking for indicators of compromise across dumps from several hosts.
• Forensics CTF challenges, where you are often handed a .raw, .mem or .vmem file and asked to find the flag inside.

Only analyse dumps from your own systems, lab machines, CTF challenges or hosts you have explicit permission to examine: memory contains passwords, documents and personal data.

How to install Volatility 3

The cleanest option is pipx, which installs the vol command in an isolated environment:

pipx install volatility3
vol -h

You can also clone the official repository and run it directly to get the latest development code:

git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
pip install -r requirements.txt
python3 vol.py -h

vol -h prints the full list of available plugins. For Windows dumps, Volatility 3 tries to download the required symbols from Microsoft's servers the first time, so you will want an Internet connection or the pre-built symbol packs the project provides. For Linux you need a symbol table (ISF) matching the exact kernel of the dump, which you generate with the dwarf2json tool.

Where do I get a memory dump?

For practice, the easiest route is dumps from CTF challenges or public labs. To capture memory from your own machines, WinPmem, DumpIt or FTK Imager work on Windows, and LiME or AVML on Linux. With virtual machines, the memory file from a snapshot (such as VMware's .vmem) can be analysed too.

How to use Volatility: practical examples

The general syntax never changes: vol -f <dump> <plugin> [options].

Identify the system

vol -f mem.raw windows.info

Shows the Windows version, architecture and system time at capture. Run it first to confirm symbols resolve correctly.

Running processes

vol -f mem.raw windows.pslist
vol -f mem.raw windows.pstree
vol -f mem.raw windows.psscan

pslist walks the active process list, pstree shows it as a parent-child tree and psscan scans all of memory for process structures, so it can surface terminated or hidden processes that pslist misses. Comparing the two is a classic way to catch rootkits.

Command lines and DLLs

vol -f mem.raw windows.cmdline
vol -f mem.raw windows.dlllist --pid 1234

Command lines often give the game away, for example a powershell.exe launched with a Base64-encoded payload, which is very common in real intrusions.

Network connections

vol -f mem.raw windows.netscan

Lists sockets and connections with local and remote addresses, ports and the owning process.

Finding injected code

vol -f mem.raw windows.malfind

Looks for executable, writable memory regions that are not backed by a file on disk, a typical sign of code injection. It does produce false positives (JIT-compiled code, for instance), so review every hit.

Files, registry and export

vol -f mem.raw windows.filescan | grep -i flag
vol -f mem.raw -o output windows.dumpfiles --pid 1234
vol -f mem.raw windows.registry.hivelist
vol -f mem.raw -r csv windows.pslist > processes.csv

-o sets the folder for extracted files and -r changes the output renderer (such as csv or json), handy for loading results into a spreadsheet or your SIEM.

Linux dumps

vol -f linux.mem linux.pslist
vol -f linux.mem linux.bash

linux.bash recovers the Bash command history held in memory, even if the attacker wiped the history file on disk.

Pro tips

• Follow a method: system info, processes, process tree, command lines, network, injection, and finally artefact extraction. It stops you drowning in plugins.
• Hunt for odd parent-child pairs: a cmd.exe spawned by an Office application or a browser deserves a closer look.
• Save output to files: some plugins are slow, so run them once and work on the text with grep.
• Chain tools: analyse extracted binaries in Ghidra, decode blobs with CyberChef, carve files with Binwalk and look at related traffic in NetworkMiner.
• Work on copies and hash the original dump to preserve chain of custody in real cases.

Pros and cons

Pros	Cons
Free, open source and an industry standard	Steep learning curve
Supports Windows, Linux and macOS	Linux symbols take effort
Highly extensible through plugins	Command line only
Output exportable to CSV or JSON	Many tutorials still use Volatility 2 syntax

Volatility alternatives

• MemProcFS: mounts the dump as a virtual file system you can browse with a file manager or terminal.
• Volatility 2: still common in older courses and writeups; useful for reading them, not for starting out.
• Redline: a free GUI tool aimed at incident response on Windows.

Frequently asked questions

Is Volatility free?

Yes. It is an open-source project maintained by the Volatility Foundation and available on GitHub and PyPI.

Volatility 2 or Volatility 3?

Learn Volatility 3: it runs on Python 3, needs no profiles and is the actively developed version. Knowing the equivalent version 2 commands helps when reading older writeups.

Why doesn't Volatility recognise my dump?

It is usually a symbols problem: on Windows, no connection to download them; on Linux, no ISF table for the exact kernel. Also check the file is not truncated or compressed.

Can I run Volatility on Windows?

Yes, it runs anywhere Python 3 does. Install it the same way with pipx install volatility3.

If you want to build the Linux and command-line foundation that forensics demands, practise at the Hackers en Acción Academy.