Volatility
Reading the forensic fingerprints left behind in a computer's live memory.
What it is
About Volatility
Volatility is an open-source memory forensics framework used by digital forensics and incident response teams to analyse RAM captures from compromised or suspect systems. It extracts artefacts like running processes, network connections, loaded DLLs, injected code, command history and encryption keys that often don't exist anywhere on disk, making it essential for investigating malware and advanced intrusions that operate primarily in memory.
What you can do with it
Capabilities
Analyse a memory dump to list running and hidden processes at time of capture
Extract network connections and open handles active in memory
Detect code injection, rootkits and process hollowing
Recover passwords, encryption keys or command history held only in RAM
Reconstruct a timeline of attacker activity for incident response reporting
How to learn it
Learning Resources
The official Volatility Foundation documentation and Volatility 3 GitHub repository
SANS FOR508 (Advanced Incident Response, Threat Hunting and Digital Forensics) course material
TryHackMe and CyberDefenders memory-forensics practice rooms and challenges
Practising against publicly available sample memory images from the Volatility project
Pro Tip
Always confirm the correct OS and profile or symbol table for the memory image before running plugins — using the wrong profile silently produces plausible-looking but wrong output rather than an obvious error.
Skills that use this tool
Roles that use this tool