Volatility

What is Volatility?

Volatility is the industry-standard open-source memory forensics framework. It allows investigators and security professionals to extract digital artifacts from RAM dumps — including running processes, network connections, registry hives, loaded DLLs, and injected malware — without needing a live system. It supports memory images from Windows, Linux, and macOS.

Installation

# Update packages
sudo apt update

# Install Volatility 2 (available on Kali repos)
sudo apt install volatility -y

# OR install Volatility 3 (recommended, Python-based)
git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
pip3 install -r requirements.txt

# Verify
python3 vol.py -h

Basic Usage

# Always start by identifying the OS profile (Volatility 2)
volatility -f memory.dmp imageinfo

# List running processes
volatility -f memory.dmp --profile=Win7SP1x64 pslist

# Show process tree (parent/child relationships)
volatility -f memory.dmp --profile=Win7SP1x64 pstree

# List active network connections
volatility -f memory.dmp --profile=Win7SP1x64 netscan

# Dump a specific process by PID
volatility -f memory.dmp --profile=Win7SP1x64 procdump -p 1234 -D ./output/

# Scan for injected code / hollowing
volatility -f memory.dmp --profile=Win7SP1x64 malfind

Common Plugins

• pslist — List all running processes from the EPROCESS linked list
• pstree — Display processes as a parent/child tree
• netscan — Show active and recently closed network connections
• malfind — Detect memory regions with injected shellcode or hollowing
• dlllist — List DLLs loaded by each process
• hashdump — Extract NTLM password hashes from memory
• filescan — Scan for file objects in memory
• cmdscan — Recover commands typed into cmd.exe

Common Use Cases

• Authorized penetration testing engagements
• CTF (Capture The Flag) competitions
• Incident response and malware analysis
• Digital forensics investigations

Further Reading

Practice on legal targets like TryHackMe, HackTheBox, or hackzia.site labs. Always read the official documentation before using in a live engagement.