// what it is
Description
Volatility 3 (Python-rewrite of the original Volatility 2) parses raw memory dumps from Windows/Linux/macOS and exposes process lists, network connections, registry hives, injected code, and decrypted artifacts.
// use cases
What people use it for
- Post-incident memory triage
- Detect process injection / hollowing
- Recover credentials from LSASS dumps
// commands
The commands you'll type
Process list (Windows)
$ vol -f mem.raw windows.pslistDetect injection
$ vol -f mem.raw windows.malfindDump LSA secrets
$ vol -f mem.raw windows.lsadump