← All tools

Volatility 3

https://github.com/volatilityfoundation/volatility3

Open Source ◆ Kali Linux

Categories

Forensics

Description

Framework for extracting digital artifacts from volatile memory (RAM) dumps. Supports Windows, Linux, and macOS memory images. Extracts processes, network connections, injected code, registry hives, and more.

Keywords

memory forensics RAM analysis process listing network connections malware detection hash dump Windows Linux

Example Usage

python3 vol.py -f memory.dmp windows.pslist
python3 vol.py -f memory.dmp windows.netscan
python3 vol.py -f memory.dmp windows.malfind
python3 vol.py -f memory.dmp windows.hashdump