Memory Forensics with Volatility

A memory dump (.raw, .mem, .vmem, .lime) is a snapshot of everything that was in RAM when it was captured — running processes, open files, network connections, command history, clipboard contents, and credentials. Volatility is the standard tool for extracting these artifacts.

Unlike disk forensics, memory captures things that were never written to disk: passwords typed into a terminal, encryption keys in use, data from running processes. The workflow is straightforward — always start with strings before running Volatility.

Volatility 2 is archived. Use Volatility 3 (pip3 install volatility3) for new analyses. See github.com/volatilityfoundation/volatility3.

Analysis Workflow

Installation

pip3 install volatility3

Volatility 2 vs 3

Auto-detects OS, no profile needed:

vol -f memory.raw windows.info        # identify OS
vol -f memory.raw linux.banner        # Linux kernel banner

vol -f memory.raw windows.pslist      # process list
vol -f memory.raw windows.pstree      # tree view
vol -f memory.raw windows.psscan      # scan for hidden processes

vol -f memory.raw windows.cmdline
vol -f memory.raw windows.cmdscan
vol -f memory.raw windows.consoles

vol -f memory.raw windows.netstat
vol -f memory.raw windows.netscan

vol -f memory.raw windows.filescan
vol -f memory.raw windows.hashdump

Analysis Steps

Quick string search

strings memory.raw | grep -i "flag{"
strings -e l memory.raw | grep "flag{"    # UTF-16LE (Windows)
strings -n 10 memory.raw | grep -iE "(CTF|flag|secret|password)"

This often finds flags directly without needing Volatility.

Identify OS and profile

vol -f memory.raw windows.info
vol -f memory.raw linux.banner

List processes — find suspicious ones

vol -f memory.raw windows.pslist
vol -f memory.raw windows.psscan     # scan for EPROCESS structs
vol -f memory.raw windows.pstree     # parent-child tree

Compare pslist vs psscan — processes in psscan but not pslist are hidden (rootkitted).

Dump command history

vol -f memory.raw windows.cmdline    # process command lines
vol -f memory.raw windows.cmdscan    # console commands
vol -f memory.raw windows.consoles   # full console input/output

# Linux:
vol -f memory.raw linux.bash         # bash history

Find and extract files

vol -f memory.raw windows.filescan | grep -i "flag"
vol -f memory.raw windows.filescan | grep ".txt"

# Extract found file (use physaddr from filescan)
vol -f memory.raw windows.dumpfiles --physaddr 0x...

Dump process memory

vol -f memory.raw windows.memmap --pid 1234 --dump
strings pid.1234.dmp | grep -i flag

Command Reference

Common CTF Patterns

Scenario	Commands
Find flag directly	`strings` + grep
Find malware	`pslist` + `psscan`, compare; `cmdline` for suspicious args
Find password	`hashdump`, `lsadump`, `strings`
Find flag file	`filescan` + `dumpfiles`
Find persistence	`registry.printkey` → Run keys
Find injected code	`malfind`

Checklist

strings memory.raw | grep flag — fastest check first
Identify OS (windows.info / linux.banner)
List processes (pslist, psscan, pstree)
Check for hidden processes (pslist vs psscan diff)
Network connections (netscan / netstat)
Command history (cmdline, cmdscan, consoles)
File scan (filescan) → extract interesting files (dumpfiles)
Dump suspicious process memory → strings
hashdump / lsadump for credentials

Last updated on Aug 1, 2025

Memory Forensics with Volatility

Network connections

Registry and credentials

Malware detection

Linux-specific

On this page