How to Use Volatility for Memory Forensics

Last updated: March 22, 2026

Volatility is the standard framework for analyzing memory dumps. While disk forensics tells you what was stored, memory forensics tells you what was actively running. including fileless malware, injected shellcode, and processes that have already deleted themselves from disk. This guide covers Volatility 3 on Linux, analyzing Windows and Linux memory images.

What You Can Extract from RAM

Running processes (including hidden/injected ones)
DLLs and modules loaded by each process
Open network connections with remote IPs and ports
Registry hives loaded in memory
Command-line arguments of processes
Encryption keys (BitLocker, TrueCrypt) if they were active
Browser credentials cached in memory
Injected shellcode via VAD (Virtual Address Descriptor) analysis

Install Volatility 3

Ubuntu / Debian
sudo apt install -y python3 python3-pip python3-venv git

python3 -m venv ~/vol3env
source ~/vol3env/bin/activate

pip install volatility3

Or from source for latest plugins
git clone https://github.com/volatilityfoundation/volatility3.git ~/volatility3
cd ~/volatility3
pip install -r requirements.txt
python3 vol.py --version

Acquire a Memory Dump

From a running Linux system (for your own forensics lab):

Using LiME (Linux Memory Extractor)
sudo apt install -y build-essential linux-headers-$(uname -r)

git clone https://github.com/504ensicsLabs/LiME.git /tmp/lime
cd /tmp/lime/src && make

Load module and dump to file
sudo insmod lime-$(uname -r).ko "path=/tmp/memory.lime format=lime"
ls -lh /tmp/memory.lime

From a running Windows system (authorized investigation only):

Use WinPmem - winpmem_mini_x64.exe memory.raw

From a VM snapshot:

VirtualBox: VBoxManage debugvm <vmname> dumpvmcore --filename memory.elf VMware - The .vmem file in the VM directory is the raw memory dump.

Identify the Profile / Symbol Table

Volatility 3 uses symbol tables instead of profiles. For Windows, it auto-detects the OS version. For Linux, you need a symbol table matching the exact kernel version.

vol.py -f memory.lime windows.info
OR
vol.py -f memory.raw imageinfo   # older compat command

For Linux images, generate or download a symbol table:
dwarf2json (converts kernel dwarf info to Volatility symbol table)
git clone https://github.com/volatilityfoundation/dwarf2json.git
cd dwarf2json && go build

./dwarf2json linux --elf /boot/vmlinux-$(uname -r) > \
  ~/volatility3/volatility3/symbols/linux/$(uname -r).json.xz

List Running Processes

Windows memory
vol.py -f memory.raw windows.pslist

Linux memory
vol.py -f memory.lime linux.pslist

pstree. shows parent-child relationships (good for spotting unusual spawns)
vol.py -f memory.raw windows.pstree

psscan. finds processes by scanning memory, catches hidden processes
that are unlinked from the process list
vol.py -f memory.raw windows.psscan

Compare pslist (walks the process list) with psscan (scans all memory). Processes in psscan but not in pslist are hidden. a strong malware indicator.

Inspect Network Connections

Windows. active and recently closed connections
vol.py -f memory.raw windows.netscan

Linux
vol.py -f memory.lime linux.netstat

Windows XP (older format)
vol.py -f memory.raw windows.connections

Example output:

Offset    Proto  LocalAddr          ForeignAddr        State    PID  Owner
0xfa8...  TCPv4  192.168.1.10:443   203.0.113.5:54321  CLOSE_W  1234 chrome.exe
0xfa9...  TCPv4  0.0.0.0:4444       0.0.0.0:0          LISTEN   5678 svchost.exe

Port 4444 listening from svchost.exe is a Metasploit default. investigate further.

Detect Code Injection (malfind)

malfind scans VAD entries for memory regions that are executable, writeable, and not backed by a file on disk. the classic signature of injected shellcode:

vol.py -f memory.raw windows.malfind

Dump suspicious regions to files for further analysis
vol.py -f memory.raw windows.malfind --dump --dump-dir /tmp/injected/

ls /tmp/injected/
pid.1234.vad.0x400000.dmp
pid.1234.vad.0x500000.dmp

Analyze dumped regions with YARA or upload to VirusTotal:

Scan with YARA rules
yara /path/to/rules.yar /tmp/injected/ -r

Get hash for VirusTotal lookup
sha256sum /tmp/injected/pid.1234.vad.0x400000.dmp

List DLLs for a Specific Process

List all DLLs loaded by process ID 1234
vol.py -f memory.raw windows.dlllist --pid 1234

Spot DLLs loaded from temp directories or unusual paths
vol.py -f memory.raw windows.dlllist | grep -i "\\\\temp\\\\"
vol.py -f memory.raw windows.dlllist | grep -i "\\\\appdata\\\\"

Dump a Specific Process

Dump entire process memory space
vol.py -f memory.raw windows.memmap --pid 1234 --dump --dump-dir /tmp/proc_1234/

Dump just the executable
vol.py -f memory.raw windows.dumpfiles --pid 1234 --dump-dir /tmp/proc_1234/

Strings analysis of the process dump
strings /tmp/proc_1234/*.dmp | grep -iE "http|ftp|cmd|powershell|base64"

Windows Registry Hives in Memory

List registry hives loaded in memory
vol.py -f memory.raw windows.registry.hivelist

Print key/value from a specific hive
vol.py -f memory.raw windows.registry.printkey \
  --key "Software\\Microsoft\\Windows\\CurrentVersion\\Run"

Common persistence locations to check
vol.py -f memory.raw windows.registry.printkey \
  --key "SYSTEM\\CurrentControlSet\\Services"

Detect Kernel Rootkits (SSDT Hooks)

Rootkits modify the System Service Descriptor Table (SSDT) to intercept system calls:

Check for SSDT hooks (Windows)
vol.py -f memory.raw windows.ssdt

Any entry not pointing into ntoskrnl.exe or win32k.sys is suspicious
vol.py -f memory.raw windows.ssdt | grep -v "ntoskrnl\|win32k"

Check for hidden kernel modules
vol.py -f memory.raw windows.modules   # official list
vol.py -f memory.raw windows.modscan   # full scan
Entries in modscan but not modules = hidden driver

Extract Password Hashes

Windows SAM hashes (if you have SYSTEM + SAM hive offsets)
vol.py -f memory.raw windows.hashdump

LSASS process contains NTLM hashes in memory
vol.py -f memory.raw windows.lsadump

Extract cached credentials
vol.py -f memory.raw windows.cachedump

Automated Triage Script

#!/usr/bin/env python3
"""
Quick triage - run key Volatility plugins and save output.
Usage - python3 triage.py memory.raw /tmp/triage_output/
"""
import subprocess, sys, os

DUMP    = sys.argv[1]
OUTDIR  = sys.argv[2]
os.makedirs(OUTDIR, exist_ok=True)

PLUGINS = [
    "windows.pslist", "windows.psscan", "windows.pstree",
    "windows.netscan", "windows.malfind",
    "windows.dlllist", "windows.registry.hivelist",
    "windows.modules", "windows.modscan",
]

for plugin in PLUGINS:
    outfile = os.path.join(OUTDIR, plugin.replace(".", "_") + ".txt")
    cmd = ["vol.py", "-f", DUMP, plugin]
    print(f"[*] Running {plugin}...")
    with open(outfile, "w") as f:
        subprocess.run(cmd, stdout=f, stderr=subprocess.DEVNULL)
    print(f"    Saved → {outfile}")

print("\n[+] Triage complete.")