Volatility ¶

Volatility is a popular free memory forensics tool. There is a deprecated python2 version (which is hard to install, 6.8k ⭐), and there is a python3 version (2.1k ⭐, in-development).

$ pipx install git+https://github.com/volatilityfoundation/volatility3
$ vol -h

Use -f to load a memory dump. Assuming the memory dump is mdump.sav in the current folder, you would use:

$ vol -f mdump.sav [...]

Profiles from volatility 2 are now expressed as plugins. You will use xxx.info instead of imageinfo (to learn about the operating system in use in the capture) with xxx a value among windows, linux, or mac.

Assuming that the host is running Windows, we can use:

• ➡️ Find information about the operating system

$ vol [...] windows.info

• ➡️ List running processes

$ vol [...] windows.pslist
$ vol [...] windows.pstree
$ vol [...] windows.cmdline

👉 Malicious processes tend to hide themselves.

• ➡️ Scan a specific process

$ vol [...] windows.psscan
$ vol [...] windows.handles --pid XXX
$ vol [...] windows.memmap --pid XXX --dump
$ vol [...] windows.dlllist --pid XXX

• ➡️ Show processes in which some code may have been injected

$ vol [...] windows.malfind
$ vol [...] windows.malfind --pid=XXX

• ➡️ Dump a specific process files

$ vol [...] windows.dumpfiles --pid xxx -o path/to/extract/dll

• ➡️ Show network activity

$ vol [...] windows.netstat

• THM/volatility
• volatility-cheatsheet