Volatility
Memory (RAM) forensics framework.
KaliParrotLinuxpassive
pkg: volatility3
Volatility analyses memory dumps to recover processes, network connections, injected code, credentials and more.
Syntax
vol -f {dump} {plugin}
Example
vol -f memory.raw windows.pslist
Lists the processes that were running when the memory image was captured.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
volatility
Usage examples
vol -f mem.raw windows.pslist
List processes from a memory dump.
vol -f mem.raw windows.netscan
Recover network connections.
Advantages
- Deep RAM analysis (malware/IR)
- Huge plugin ecosystem
- OS-agnostic profiles
Disadvantages
- Steep learning curve
- Profile/symbol matching needed
- Slow on large dumps
Tags
#memory#dfir
Official docs: Volatility 3 ↗
Related commands
Frequently asked questions
What is Volatility used for?
Volatility analyses memory dumps to recover processes, network connections, injected code, credentials and more.
What is an example Volatility command?
A common example is: vol -f memory.raw windows.pslist — Lists the processes that were running when the memory image was captured.
Is Volatility part of Kali Linux?
Yes. Volatility ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install volatility3.
What category of security tool is Volatility?
Volatility is a Forensics tool with a passive-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.