Volatility

Memory (RAM) forensics framework.

KaliParrotLinuxpassive

pkg: volatility3

Volatility analyses memory dumps to recover processes, network connections, injected code, credentials and more.

Syntax

vol -f {dump} {plugin}

Example

vol -f memory.raw windows.pslist

Lists the processes that were running when the memory image was captured.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

-f <mem.raw>Memory image file.
(plugin) <windows.pslist>e.g. windows.pslist, windows.netscan.
--profile <Win10x64>(vol2) OS profile.
-o <out>Output directory for dumps.

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

volatility

Usage examples

vol -f mem.raw windows.pslist

List processes from a memory dump.

vol -f mem.raw windows.netscan

Recover network connections.

Advantages
  • Deep RAM analysis (malware/IR)
  • Huge plugin ecosystem
  • OS-agnostic profiles
Disadvantages
  • Steep learning curve
  • Profile/symbol matching needed
  • Slow on large dumps
Tags
#memory#dfir

Official docs: Volatility 3

Related commands

Frequently asked questions

What is Volatility used for?
Volatility analyses memory dumps to recover processes, network connections, injected code, credentials and more.
What is an example Volatility command?
A common example is: vol -f memory.raw windows.pslist — Lists the processes that were running when the memory image was captured.
Is Volatility part of Kali Linux?
Yes. Volatility ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install volatility3.
What category of security tool is Volatility?
Volatility is a Forensics tool with a passive-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →