Volatility

Memory forensics — process, network, injection & credential plugins

Volatility (Memory Forensics) Cheat Sheet

Volatility is an open-source memory-forensics framework for extracting artifacts (processes, network connections, injected code, credentials) from RAM dumps. This sheet covers Volatility 3 with Volatility 2 equivalents noted. For authorized testing only.

1. Volatility 3 vs. Volatility 2

	Volatility 3	Volatility 2
Invoke	`vol -f mem.raw windows.pslist`	`vol.py -f mem.raw --profile=... pslist`
Profile	Auto-detected (no `--profile`)	Required: `--profile=Win10x64_19041`
Plugin names	`windows.pslist`, `linux.bash`	`pslist`, `linux_bash`

# Volatility 3
vol -f memory.raw windows.info       # image metadata / verify OS

# Volatility 2
vol.py -f memory.raw imageinfo       # suggest profiles
vol.py -f memory.raw kdbgscan        # confirm the profile

2. Core syntax & options

vol -f <image> <plugin> [args]
vol -f mem.raw -o ./out windows.dumpfiles   # -o = output dir for dumped files
vol -h                                       # global help
vol -f mem.raw windows.pslist -h             # plugin-specific help
vol --info | grep windows                    # list available plugins
vol -r json -f mem.raw windows.pslist        # render as JSON (-r csv|json|pretty)

3. Process listing & hunting

Task	Volatility 3	Volatility 2
Process list	`windows.pslist`	`pslist`
Hidden/unlinked procs	`windows.psscan`	`psscan`
Parent/child tree	`windows.pstree`	`pstree`
Cross-view rootkit check	`windows.psxview`*	`psxview`
Command line	`windows.cmdline`	`cmdline`
DLLs per process	`windows.dlllist`	`dlllist`
Open handles	`windows.handles`	`handles`

vol -f mem.raw windows.pstree
vol -f mem.raw windows.cmdline --pid 1234

*Compare pslist (linked list) vs psscan (pool scan): processes in psscan but not pslist are likely hidden.

4. Network artifacts

# Volatility 3
vol -f mem.raw windows.netscan      # connections + listening sockets (Vista+)
vol -f mem.raw windows.netstat

# Volatility 2
vol.py -f mem.raw --profile=... connscan   # TCP connections (XP/2003)
vol.py -f mem.raw --profile=... sockets
vol.py -f mem.raw --profile=... netscan     # Vista+

5. Code injection & malware

vol -f mem.raw windows.malfind                 # injected/hidden code (RWX, no file)
vol -f mem.raw windows.malfind --pid 1234 --dump
vol -f mem.raw windows.ldrmodules              # unlinked DLLs (3 lists compared)
vol -f mem.raw windows.svcscan                 # Windows services
vol -f mem.raw windows.driverscan              # loaded drivers
vol -f mem.raw windows.ssdt                    # SSDT hooks

6. Dumping processes & memory

vol -f mem.raw -o ./dump windows.pslist --pid 1234 --dump   # dump the EXE
vol -f mem.raw -o ./dump windows.memmap --pid 1234 --dump   # full process memory
vol -f mem.raw -o ./dump windows.dlllist --pid 1234 --dump  # dump DLLs
vol -f mem.raw -o ./dump windows.dumpfiles --pid 1234       # cached files

# Volatility 2 equivalents
vol.py -f mem.raw --profile=... procdump -p 1234 -D dump/
vol.py -f mem.raw --profile=... memdump  -p 1234 -D dump/

7. Credentials & registry

vol -f mem.raw windows.registry.hivelist       # locate hives
vol -f mem.raw windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run"
vol -f mem.raw windows.hashdump                # SAM hashes (NTLM)
vol -f mem.raw windows.lsadump                 # LSA secrets
vol -f mem.raw windows.cachedump               # cached domain creds

8. Files, strings & timeline

vol -f mem.raw windows.filescan                # file objects in memory
vol -f mem.raw windows.dumpfiles --virtaddr 0x...
vol -f mem.raw windows.envars                  # environment variables
vol -f mem.raw timeliner.Timeliner             # build a timeline of artifacts

# Map a string offset back to a process (classic technique)
strings -td memory.raw | grep "flag{" 
vol -f mem.raw windows.strings --strings-file found.txt

9. Linux & Mac

vol -f mem.lime linux.pslist
vol -f mem.lime linux.bash            # recover bash history from memory
vol -f mem.lime linux.pstree
vol -f mem.lime linux.check_syscall   # syscall table hooks
vol -f mem.lime linux.lsof
vol -f mem.raw  mac.pslist

10. Typical investigation flow

# 1. Identify the image
vol -f mem.raw windows.info

# 2. Survey processes, look for odd parents/names
vol -f mem.raw windows.pstree
vol -f mem.raw windows.psscan        # then diff against pslist for hidden procs

# 3. What were they doing / talking to?
vol -f mem.raw windows.cmdline
vol -f mem.raw windows.netscan

# 4. Hunt injected code, dump the suspect
vol -f mem.raw windows.malfind --pid <suspect>
vol -f mem.raw -o ./out windows.pslist --pid <suspect> --dump

# 5. Pull creds / persistence
vol -f mem.raw windows.hashdump
vol -f mem.raw windows.registry.printkey --key "...\CurrentVersion\Run"

11. Tips

Volatility 3 auto-detects the OS — symbol tables download on first run; for offline use, fetch symbol packs to volatility3/symbols/.
For Volatility 2, nail the profile first (imageinfo → kdbgscan); a wrong profile yields garbage.
Always work on a copy of the image and record hashes (sha256sum mem.raw).
psscan/netscan (pool scanning) survive unlinking — use them to beat rootkits that hide from pslist.

Authorized testing only. Practice on the AYSEC challenges. Pair with Wireshark display filters when a dump references network activity.