Volatility Cheat Sheet

Memory forensics framework for extracting processes, credentials, and malware artifacts from RAM dumps.

Forensics & IRmalwarememoryramUpdated 2026-06-02

Overview

Volatility analyzes physical memory images (Windows, Linux, macOS). Use after acquiring RAM with WinPMEM, LiME, or hypervisor snapshots to find processes, network connections, injected code, and cached credentials.

Authorized testing only. Use only on systems, networks, and accounts you own or have explicit written permission to test. Unauthorized access is illegal.

Install

Volatility 3 (recommended)

pip install volatility3

vol -h

Volatility 2 (legacy)

sudo apt install -y volatility

Essential commands

Vol3 — identify image

vol -f memory.raw windows.info

vol -f memory.raw linux.banner

Plugin list

vol -f memory.raw -h | grep windows

Common workflows

Windows triage (Volatility 3) —

vol -f win10.raw windows.info

vol -f win10.raw windows.pslist

vol -f win10.raw windows.pstree

vol -f win10.raw windows.netscan

vol -f win10.raw windows.cmdline

vol -f win10.raw windows.malfind

vol -f win10.raw windows.hashdump

vol -f win10.raw windows.registry.hivelist

Linux memory —

vol -f linux.raw linux.bash

vol -f linux.raw linux.pslist

vol -f linux.raw linux.check_syscall

vol -f linux.raw linux.envars

Process-specific dump —

vol -f win10.raw windows.memmap --pid 1234 --dump

vol -f win10.raw windows.vadinfo --pid 1234

strings -n 8 pid.1234.dmp | grep -i password

Volatility 2 (legacy syntax) —

volatility -f mem.raw --profile=Win10x64_19041 pslist

volatility -f mem.raw --profile=Win10x64_19041 malfind

volatility -f mem.raw --profile=Win10x64_19041 hashdump

Flags reference

`-f FILE`	Memory image path
`windows.info`	OS build / layer info
`--single-location`	Force layer (advanced)
`-r SYMBOLDIR`	Symbol path (Vol3)
`--pid N`	Target process
`-o DIR`	Output directory for dumps
`--profile`	Vol2 only — profile name

Tips

Wrong profile (Vol2) or missing symbols (Vol3) → garbage output; run windows.info first.
Combine with YARA on dumped process segments.
Modern Win11 builds need updated symbol packs frequently.
For live response, prefer disk + memory acquisition before shutdown.