security enabled verified low v1.0.0

volatility

Advanced memory forensics framework for analyzing RAM dumps, extracting processes, network connections, registry hives, and artifacts.

📋 Live Preview

volatility -f {memory-dump} {plugin}

🌍 memory-dump → memory.raw 🌍 plugin → windows.pslist

volatility -f {memory-dump} {plugin}

Sandbox: execFile · Timeout: 600s

Capabilities

memory.analysis.process

memory.analysis.network

memory.analysis.registry

memory.analysis.dump

forensics.memory.acquisition

Parameters

Name	Type	Required	Default	Description	Aliases
`flag-f`	file	Yes	-	Memory dump file to analyze	`-f`, `--file`
`flag-p`	string	No	-	Additional plugin directory path	`-p`, `--plugin-path`
`flag-r`	integer	No	0	Recursion depth for layered plugins	`-r`, `--recursion`
`flag-v`	integer	No	1	Verbosity level (1-5)	`-v`, `--verbose`
`flag-q`	boolean	No	-	Quiet mode — suppress output except errors	`-q`, `--quiet`
`flag-y`	string	No	-	YARA rule file for scanning	`-y`, `--yara`
`flag-l`	boolean	No	-	List all available plugins	`-l`, `--list-plugins`
`flag-s`	integer	No	-	Session ID to resume or manage	`-s`, `--sessions`
`flag-c`	file	No	-	Configuration file path	`-c`, `--config`
`flag-o`	string	No	text	Output format (text, json, sqlite)	`-o`, `--output`
`single-location`	string	No	-	Single memory location to scan	`--single-location`
`physical`	boolean	No	-	Use physical address space	`--physical`
`output-dir`	string	No	-	Directory for output files	`--output-dir`
`flag-i`	boolean	No	-	Display information about the memory dump	`-i`, `--info`
`plugin`	string	No	-	Plugin to run (e.g. windows.pslist, windows.netscan)	`windows.info`, `windows.pslist`, `windows.netscan`, `windows.hivelist`, `windows.hashdump`, `linux.bash`, `linux.pslist`, `mac.pslist`
`output_dir`	boolean	No	-	DIR Directory for output files	`--output-dir`
`r`	boolean	No	-	N Recursion depth (default: 0)	`-r`, `--recursion`
`s`	boolean	No	-	ID Session management	`-s`, `--sessions`
`y`	boolean	No	-	FILE YARA rule file	`-y`, `--yara`

Artifacts

Type	Description	MIME	Schema	Trust
`memory.dump.raw`	Raw memory dump file	application/octet-stream	-	verified
`forensics.report.json`	Volatility analysis results in JSON	application/json	-	verified
`forensics.report.text`	Volatility analysis results in text	text/plain	-	verified

Contract

Inputs

memory.dump.file

Path to the memory dump file

forensics.plugin

Volatility plugin to execute (e.g. windows.pslist)

directory.path

Path to additional plugin directory

Outputs

forensics.report.text

Plugin output as plain text

forensics.report.json

Plugin output as JSON

Side effects: filesystem_writefilesystem_write

Workflow Edges

Produces

forensics.report.textforensics.report.json

Consumes

memory.dump.fileforensics.plugindirectory.path

Resource Profile

Resource	Value
CPU	high
Memory	2048 MB
Network	none
Disk I/O	high

Examples

List running processes from a Windows memory dump

volatility -f memory.raw windows.pslist

Scan network connections from a memory dump

volatility -f memory.raw windows.netscan

Dump registry hives from a memory dump

volatility -f memory.raw windows.hivelist

Extract password hashes from a memory dump

volatility -f memory.raw windows.hashdump

List available plugins

volatility -l

Show memory dump info and profile suggestion

volatility -f memory.raw windows.info

List bash history from a Linux memory dump

volatility -f linux.mem linux.bash

Use custom plugin directory

volatility -f memory.raw -p /opt/volatility_plugins windows.pslist

Documentation

Volatility — Memory Forensics Framework

Volatility is an advanced open-source memory forensics framework written in Python. It analyzes RAM dumps from Windows, Linux, and macOS systems to extract running processes, open network connections, loaded kernel modules, registry hives, and other critical forensic artifacts.

Key Features

Cross-platform: Supports Windows, Linux, and macOS memory dumps
Plugin architecture: Dozens of analysis plugins included
No dependency on live system: Works entirely from a memory capture
Extensible: Custom plugins can be written in Python

Common Plugins

Plugin	Purpose
`windows.pslist`	List running processes
`windows.netscan`	Scan network connections
`windows.hivelist`	Show registry hives
`windows.hashdump`	Extract password hashes
`windows.info`	Show dump metadata
`linux.bash`	Recover bash history
`mac.pslist`	List macOS processes