Summary
Memory forensics without the command-line vocabulary.
Volatility's power has always been behind a plugin syntax you have to know before you can ask anything. Opening the image and identifying the OS become the first two calls, and after that the questions are ordinary ones — with the whole plugin catalogue still reachable when the ordinary questions run out.
What it is
Volatility3, the memory forensics framework, driven through an assistant. You point it at a memory image once; after that, processes, connections, handles and plugin output are questions rather than command lines.
What you get
- A memory image opened and prepared for analysis
- The operating system behind the dump identified
- Running processes listed, and the open handles of any one of them
- Network connections, for spotting where a machine was talking to
- A YARA scan across memory for known malware signatures
- The full Volatility plugin catalogue — listed, described, and any of them run
Requirements
Volatility3 and its Python dependencies installed, and a memory dump to analyze. Windows and Linux images are supported.