Volatility is the leading open-source framework for memory forensics. It analyses RAM captures (memory dumps) to reconstruct what a system was doing at the moment of capture, information that never touches disk. Investigators use it to list running processes, network connections, loaded drivers, injected code, command history and more from a dump. The current major version, Volatility 3, uses plugins named per operating system (for example windows.pslist) and is a core DFIR and malware-analysis tool.
Last updated: 6 August 2026
Volatility extracts volatile evidence from a memory image. A responder investigating a compromised host runs process-listing plugins to spot suspicious or hidden processes, checks network connections for command-and-control, and uses malfind to locate injected or unbacked executable memory that indicates code injection. It can dump a suspicious process for further analysis, pull command-line arguments, and recover artefacts like registry data cached in memory. It is central to incident response and malware analysis because in-memory-only threats leave little or no trace on disk.
Linux · Windows · macOS (Python)
Open source (Volatility Software License / GPLv2 for v2)
python3 vol.py -f memdump.raw windows.infoIdentify the OS and image metadata to confirm the profile Volatility 3 detects.
python3 vol.py -f memdump.raw windows.pslistList processes that were running from the process linked list.
python3 vol.py -f memdump.raw windows.pstreeShow processes as a parent-child tree to spot suspicious relationships.
python3 vol.py -f memdump.raw windows.malfindFind memory regions likely containing injected/executable code.
python3 vol.py -f memdump.raw windows.netscanRecover network connections and listening sockets from the dump.
python3 vol.py -f memdump.raw windows.cmdlineShow the command-line arguments each process was started with.
python3 vol.py -f memdump.raw windows.dumpfiles --pid 1234Extract files/artefacts associated with a specific process for analysis.
Acquire and analyse memory only from systems you own or are authorised to investigate. A RAM dump can contain passwords, keys, private messages and other highly sensitive data, so handle it under proper authorisation, chain of custody and hash verification, consistent with the IT Act 2000 and evidence rules. Unauthorised access to a device to capture its memory is an offence.
Volatility only analyses a memory image you already captured; acquiring that dump correctly is a separate, error-prone step, and a memory image is a single point-in-time snapshot. Analysis can fail if the OS build is unsupported by available symbols, and anti-forensic or rootkit techniques can hide or corrupt in-memory evidence.
| Tool | Pick it when |
|---|---|
| Rekall | You want an alternative memory-forensics framework (now largely inactive). |
| MemProcFS | You want to mount a memory dump as a browsable virtual file system. |
| Redline | You want a free GUI tool from Mandiant for host/memory triage. |
| WinDbg | You need deep, interactive kernel debugging of a crash/memory dump. |
| Autopsy / Sleuth Kit | Your evidence is a disk image rather than a memory capture. |
Advanced module — memory forensics and incident response (mentored)
We are not affiliated with, endorsed by, or a reseller for the vendors of any tool on this site.
Free counselling call. We will tell you honestly whether a full course is worth it for what you actually want to do.
Call +91 75175 72000