Volatility 3 Memory Forensics Tutorial 2026 — Install, Configure & Hunt in RAM

Fileless & In-Memory Malware

PowerShell downloaders, reflective DLL injection and process hollowing often leave nothing meaningful on disk. malfind and ldrmodules surface them.

Live Network State

Beacon destinations, listening backdoors and C2 sockets that were active at capture time appear in netscan even if logs were cleared.

Credential Theft Response

Cached hashes, LSA secrets and Kerberos material sit in LSASS memory. Memory forensics confirms what an attacker could have harvested.

Rootkits & Process Hiding

Unlinked processes vanish from pslist but are still found by pool scanning with psscan — a classic hidden-process check.

Command Reconstruction

cmdline and consoles recover the exact arguments an attacker typed, including staged payload URLs and flags.

Ransomware Triage

Recover the encryptor's process tree, injected regions and, occasionally, key material that only ever existed in RAM.

A venv keeps yara-python, capstone and pefile pinned to versions Volatility expects, without polluting the OS. Create and activate it first.

The PyPI package pulls in the framework and its core dependencies. Add the optional extras to enable YARA scanning and disassembly — you will want both.

Confirm the binary is on PATH and list the plugins it discovered. A healthy install prints its version and a long list of windows.*, linux.* and mac.* plugins.

Create a slim image based on the official Python base. This pins Volatility inside the container and keeps your host clean.

Mount your evidence directory read-only (:ro) so nothing can modify the image, and mount a named volume for the downloaded symbols so they are not re-fetched every run.

For recurring work, a compose file removes the long docker run line. Drop images in ./evidence, dumps land in ./output, and symbols persist in the named volume.

Install Python 3.11+ from python.org (tick "Add python.exe to PATH"), then use a venv exactly as on Linux. Commands run from PowerShell.

The development tree carries plugins and fixes not yet released to PyPI. Clone it and install in editable mode so a git pull updates your install instantly.

If you only want the command-line tool and never import Volatility as a library, pipx installs it into its own isolated environment and exposes vol globally.

Every invocation follows the same shape: global options, then -f and the image path, then the plugin name, then any plugin-specific options. The classic form using the bundled script is python3 vol.py -f <image> plugin.name --option.

Always start here. windows.info confirms Volatility can read the image, identifies the OS build and architecture, and triggers the symbol download. If this succeeds, every other Windows plugin will work.

On an air-gapped analysis host, download the official Windows/Mac/Linux symbol packs ahead of time and drop them in the framework's symbols/ directory. Point Volatility at extra symbol locations with -s.

WinPmem is a single portable executable. Run it elevated and write the image to external media, never to the disk under investigation.

AVML is a self-contained static binary that captures physical memory on most modern Linux kernels without building a module. Ideal for cloud VMs and containers' hosts.

The forensically cleanest capture touches nothing inside the guest. VMware writes a .vmem alongside a suspended VM; VirtualBox can dump a running VM's core to disk.

Walks the active EPROCESS linked list — the same list Task Manager shows. Your baseline of "what was running." Look for odd parents, misspelled system names, and processes running from user or temp directories.

Renders the same processes as an indented tree so parent-child anomalies jump out — the classic winword.exe → cmd.exe → powershell.exe chain, or a services.exe child that should never exist.

Scans memory pools for EPROCESS structures directly instead of trusting the linked list. Rootkits that unlink themselves disappear from pslist but still appear here. Diff the two outputs.

Extracts the full command line each process was launched with. This is often where the smoking gun lives: encoded PowerShell, staged download URLs, or LOLBins invoked with attacker flags.

dlllist shows every DLL a process loaded. ldrmodules cross-checks the three loader lists — a module present in memory but missing from one of them is a hallmark of reflective/unlinked DLL injection.

Reveal what a process could touch. getsids shows the account and groups it runs as; privileges lists enabled tokens (like SeDebugPrivilege); handles exposes files, keys and mutexes it held open.

Reconstruct sockets and connections that were live at capture. netscan pool-scans for network objects (finding closed/hidden ones too); netstat walks the tracked structures. Map foreign IPs to the owning PID.

The single most valuable hunting plugin. malfind finds memory regions that are executable, writable and not backed by a file on disk — the signature of shellcode, process hollowing and reflective loaders. An MZ header in a private RWX region is a strong hit.

Assess credential exposure. hashdump extracts local SAM NTLM hashes; lsadump pulls LSA secrets; cachedump recovers cached domain logons. These tell you what an attacker with the same access could have harvested.

Carve artifacts out of the image for sandboxing or static analysis. pslist --dump writes the process executable; memmap --dump writes all its mapped pages; dumpfiles recovers cached files.

Sweep memory for known-bad byte patterns. windows.vadyarascan scans each process's virtual address space; the OS-agnostic yarascan scans the whole image. Pass a rule inline or a rules file.

The registry hives are mapped in memory. hivelist enumerates them; printkey reads a key — perfect for pulling persistence values like Run keys straight from RAM.

timeliner collects timestamped artifacts (process creation, handles, registry keys, network) into one chronological body you can sort to reconstruct the intrusion sequence.

For questions no plugin answers, volshell drops you into a Python REPL bound to the image, where you can inspect structures and read arbitrary memory. Select the layer with -w (Windows), -l (Linux) or -m (Mac).

Unlike Windows, Linux/macOS symbols are not on a public server. Build an ISF from the target kernel's debug info with dwarf2json, drop it in the symbols directory, then run the linux.* / mac.* plugins.

When you do not even know the OS, the OS-agnostic banners plugin scans for kernel version strings, telling you exactly which distro/build to source symbols for.