Volatility is an open source memory forensics framework used to perform forensic examination of RAM (volatile memory) dump files. The current version, Volatility 3, is written in Python 3 and analyzes Windows, Linux, and macOS memory dumps. A typical usage is: vol -f memdump.raw windows.pslist.

TL;DR

  • Volatility 3 = Python 3 based, open source memory forensics framework (BSD licensed, github.com/volatilityfoundation/volatility3).
  • RAM dump tools: FTK Imager, Magnet RAM Capture, DumpIt, WinPmem, LiME (Linux).
  • Commonly used plugins: windows.pslist, windows.psscan, windows.malfind, windows.cmdline, windows.netscan.
  • Volatility 3 downloads the symbol table (ISF) automatically, so the profile guessing of the older Volatility 2 is no longer needed.
  • In forensic processes it is used together with a hash chain (SHA-256), as recommended by NIST SP 800-86.

Detailed Answer

What is Volatility and what does it do?

Volatility is used to extract the following information from an image taken of a running system's RAM contents:

  • The list of active processes and hidden processes.
  • Open network connections and listening ports.
  • Command line arguments used and commands that were run.
  • Loaded DLLs, drivers, and kernel modules.
  • Traces of malicious code injection (process hollowing, reflective DLL).
  • Encryption keys (BitLocker, TrueCrypt, LUKS) and user passwords (LSASS, Mimikatz-style extractions).
  • Clipboard contents, open files, and the registry hive cache.

The difference between Volatility 2 and Volatility 3

Feature Volatility 2 Volatility 3
Python version 2.7 (EOL) 3.7+
Profile selection Manual (imageinfo) Automatic (ISF symbol table)
Plugin syntax volatility -f mem.raw --profile=Win10x64 pslist vol -f mem.raw windows.pslist
Maintained No Yes, actively
New Windows support Up to Win10 22H2 Including Win11

In DSET cases, all new analyses after 2024 are performed with Volatility 3. A Volatility 2 environment is kept as a fallback for older cases.

Installation (Linux and Windows)

# Linux (Ubuntu 22.04)
python3 -m pip install volatility3
# or from source
git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
python3 -m pip install -r requirements.txt
python3 vol.py --help

# Windows
py -m pip install volatility3
vol --help

How to take a RAM dump

Tool Platform License Feature
FTK Imager (AccessData) Windows Free GUI, write blocker compatible
Magnet RAM Capture Windows Free Fast, small footprint
DumpIt Windows Free One click, runs from USB
WinPmem Windows Apache 2.0 CLI, automation friendly
LiME (Linux Memory Extractor) Linux GPL Loaded as a kernel module
osxpmem (legacy) macOS Apache 2.0 Limited on modern macOS

Important point: the act of taking a RAM dump itself changes the system's memory state (the Heisenberg effect). In incident response, DSET performs this operation with the lightest possible tool, over USB, and with an administrative privileged account. After the dump, the SHA-256 value is recorded in the report.

8 commonly used plugins (DSET field table)

Plugin Purpose Typical command
windows.info Shows the image profile and version vol -f mem.raw windows.info
windows.pslist List of active processes (linked EPROCESS) vol -f mem.raw windows.pslist
windows.psscan Finds hidden processes (DKOM detection) vol -f mem.raw windows.psscan
windows.pstree Process tree, parent-child relationship vol -f mem.raw windows.pstree
windows.cmdline Command line arguments of processes vol -f mem.raw windows.cmdline
windows.malfind Suspicious injected code blocks vol -f mem.raw windows.malfind
windows.netscan Open network connections and ports vol -f mem.raw windows.netscan
windows.dlllist Loaded DLLs vol -f mem.raw windows.dlllist --pid 1234

The Linux equivalents are linux.pslist, linux.psaux, linux.malfind, and linux.netstat.

Step-by-step example: suspicious process analysis

  1. Take and verify a hash. sha256sum memdump.raw > memdump.sha256. This is added as an annex to the report.
  2. View the image profile. Use vol -f memdump.raw windows.info for the Windows version and kernel structure.
  3. Process list. vol -f memdump.raw windows.pslist > pslist.txt. PPID-PID anomalies (for example, an iexplore.exe that is not under explorer.exe) are flagged.
  4. Hidden process scan. vol -f memdump.raw windows.psscan. A process that does not appear in pslist but shows up in psscan is a sign of a DKOM attack.
  5. Command line. vol -f memdump.raw windows.cmdline | grep -i powershell. PowerShell's -enc (encoded) parameter is a frequently seen malicious pattern.
  6. Code injection. vol -f memdump.raw windows.malfind --pid 4892. RWX regions with an MZ header in the output are strong evidence of injection.
  7. Network connections. vol -f memdump.raw windows.netscan | grep ESTABLISHED. Active sessions with unknown IPs are compared against threat intelligence.
  8. Document the findings. Each command's output appears in the report's annex, along with the tool version information (vol --version).

Volatility and forensic admissibility

NIST SP 800-86 "Guide to Integrating Forensic Techniques into Incident Response" lists Volatility as an example among memory analysis tools. In Court of Cassation rulings, findings obtained with Volatility are accepted when the hash chain and methodology are presented correctly. For the incident response workflow, see: /en/rehber/siber-olay-mudahale-playbook-nist-800-61-checklist. For taking a RAM dump after a ransomware incident, see: /en/rehber/fidye-yazilim-ilk-24-saat-aksiyon-cizelgesi.

Common mistakes

  • Trying to take a dump from a system that has been shut down. RAM is erased within seconds after power is cut.
  • Forgetting to take a hash. It cannot be mathematically proven in court that the evidence was not altered.
  • Trying to run in an offline environment without downloading the ISF symbol file. Volatility 3 requires an internet connection on first run, then caches it.
  • Processes missed due to a wrong-architecture dump (taking a dump of a 64-bit system with a 32-bit tool).

Frequently Asked Questions (FAQ)

Is Volatility free?

Yes. Volatility 3 is free and open source under the BSD 2-Clause license. The source code is at github.com/volatilityfoundation/volatility3.

Which operating systems does it support?

All versions from Windows XP to Windows 11, Linux 2.6+, and macOS (limited). Mobile platforms (Android, iOS) require separate tools (LiME + ALEAPP, and BlackBag for iOS).

Is Volatility a replacement for Mimikatz?

No. Mimikatz runs on a live system and extracts active credentials. Volatility, on the other hand, works on a captured RAM dump and extracts the credential traces within it (the LSASS region, hashes).

How many GB is a memory dump?

The dump size is as large as the system's RAM capacity. On a Windows system with 16 GB of RAM, the dump file is approximately 16 GB; it can be reduced by 30-40% with compression.

Is AI-assisted memory analysis possible?

Yes. Volatility outputs (especially pslist, malfind, and netscan) are used with machine learning models for anomaly detection. DSET runs its AI-assisted triage model on Volatility output to automatically prioritize suspicious processes.

DSET Digital Forensics and Incident Response Team Hacettepe Teknokent, Beytepe, Ankara 20+ years of experience · ISO 27001 · CHFI/GCFA certified experts Phone: +90 536 662 38 09 · Email: [email protected] 24/7 emergency RAM dump and memory forensics.