Digital Forensics

volatility3

volatility3 is the standard tool for memory forensics. Give it a RAM dump — from a compromised machine, a malware sandbox, or a CTF challenge — and its plugins reconstruct what was happening at the moment of capture: running processes and their parents, open network connections, loaded drivers, command history, injected code, and often credentials and encryption keys sitting in memory. Because a lot of malware only ever exists in RAM, memory analysis catches things a disk image never would.

Official-repo package; Security → Digital Forensics → volatility3. The command is vol. Volatility 3 detects the OS and symbols automatically — no profiles to specify like the older version.

The help it prints

vol’s plugin list is long; this is the top — the core options:

usage: vol [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]]
           [-e EXTEND] [-p PLUGIN_DIRS] [-s SYMBOL_DIRS] [-v] [-l LOG]
           [-o OUTPUT_DIR] [-q] [-f FILE] [--write-config]
           [--save-config SAVE_CONFIG] [--clear-cache]
           [--cache-path CACHE_PATH] [--offline | -u URL] [--filters FILTERS]
           [--hide-columns [HIDE_COLUMNS ...]] [-r RENDERER]
           [--single-location SINGLE_LOCATION] [--stackers [STACKERS ...]]
           [--single-swap-locations [SINGLE_SWAP_LOCATIONS ...]]
           PLUGIN ...

An open-source memory forensics framework

options:
  -h, --help            Show this help message and exit, for specific plugin
                        options use 'vol <pluginname> --help'
  -c, --config CONFIG   Load the configuration from a json file
  --parallelism [{processes,threads,off}]
                        Enables parallelism (defaults to off if no argument
                        given)
  -e, --extend EXTEND   Extend the configuration with a new (or changed)
                        setting
  -p, --plugin-dirs PLUGIN_DIRS
                        Semi-colon separated list of paths to find plugins
  -s, --symbol-dirs SYMBOL_DIRS
                        Semi-colon separated list of paths to find symbols
  -v, --verbosity       Increase output verbosity
  -l, --log LOG         Log output to a file as well as the console
  -o, --output-dir OUTPUT_DIR
                        Directory in which to output any generated files
  -q, --quiet           Remove progress feedback
  -f, --file FILE       Shorthand for --single-location=file:// if single-
                        location is not defined
  --write-config        Write configuration JSON file out to config.json
  --save-config SAVE_CONFIG
                        Save configuration JSON file to a file
  --clear-cache         Clears out all short-term cached items
  --cache-path CACHE_PATH
                        Change the default path
                        (/home/cyberbow/.cache/volatility3) used to store the
                        cache
  --offline             Do not search online for additional JSON files
  -u, --remote-isf-url URL
                        Search online for ISF json files
  --filters FILTERS     List of filters to apply to the output (in the form of
                        [+-]columname,pattern[!])
  --hide-columns [HIDE_COLUMNS ...]

    ... (abridged)

Run `vol -h` in the terminal for the complete option list.

Examples

# List running processes from a Windows memory image
vol -f memory.dmp windows.pslist

# Show the process tree (spot suspicious parent/child relationships)
vol -f memory.dmp windows.pstree

# Network connections at capture time
vol -f memory.dmp windows.netscan

# Dump a suspicious process's memory for further analysis
vol -f memory.dmp -o ./out windows.memmap --pid 1337 --dump

# Linux image: list processes
vol -f memory.lime linux.pslist

Run vol -h for the full plugin catalog — there are dozens, grouped by OS (windows.*, linux.*, mac.*).