root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat volatility.md
// forensics

Volatility

22 Jul 2026 · 4 min read
forensicscheatsheetsvolatility

Volatility is the reference framework for volatile memory (RAM) forensic analysis: from a memory dump, it lists processes, network connections, open handles, loaded DLLs, and extracts injected files or payloads. This cheat sheet uses Volatility 3.

TypeCLI (Python)
InputRAM memory dump (.raw, .mem, .vmem...)
Volatility cheat sheet

1. Identify OS and processes

python3 vol.py -f memory.raw windows.info       # Windows version, architecture
python3 vol.py -f memory.raw windows.pslist      # process list
python3 vol.py -f memory.raw windows.pstree       # process tree (who launched whom)
python3 vol.py -f memory.raw windows.cmdline      # each process's command line

2. Network — connections (netstat)

python3 vol.py -f memory.raw windows.netscan
python3 vol.py -f memory.raw windows.netscan | grep 4444             # by port
python3 vol.py -f memory.raw windows.netscan | grep 192.168.1.50     # by IP
python3 vol.py -f memory.raw windows.netscan | grep ESTABLISHED      # by state

On PowerShell, use findstr instead of grep.

3. Handles — files, registry keys, mutexes

python3 vol.py -f memory.raw windows.handles
python3 vol.py -f memory.raw windows.handles --pid 1234
python3 vol.py -f memory.raw windows.handles --pid 1234 | grep File
python3 vol.py -f memory.raw windows.handles --pid 1234 | grep -i temp
  • See if a process has C:\Users\...\AppData\Roaming\... open
  • Find unusual mutexes (Mutant) typical of malware
  • See registry keys (Key) touched by a process

4. DLLs loaded by a process

python3 vol.py -f memory.raw windows.dlllist --pid 1234
python3 vol.py -f memory.raw windows.dlllist --pid 1234 | grep -i appdata

5. Finding and extracting files

python3 vol.py -f memory.raw windows.filescan
python3 vol.py -f memory.raw windows.filescan | grep -i "evil.exe"
# with the offset found:
python3 vol.py -f memory.raw -o out/ windows.dumpfiles --virtaddr 0xDEADBEEF

6. A process's memory

python3 vol.py -f memory.raw windows.memmap --pid 1234        # memory ranges
python3 vol.py -f memory.raw windows.vadinfo --pid 1234       # VADs
python3 vol.py -f memory.raw -o out/ windows.vadump --pid 1234   # full VAD dump

Useful for extracting injected payloads and analysing suspicious executable sections.

7. Strings — IOCs, URLs, commands

strings -a memory.raw | grep -i "http"
strings -a memory.raw | grep -i "powershell"

Recommended mini-flow

python3 vol.py -f memory.raw windows.info
python3 vol.py -f memory.raw windows.pslist
python3 vol.py -f memory.raw windows.pstree
python3 vol.py -f memory.raw windows.netscan
# for a suspicious PID:
python3 vol.py -f memory.raw windows.cmdline --pid 1234
python3 vol.py -f memory.raw windows.dlllist --pid 1234
python3 vol.py -f memory.raw windows.handles --pid 1234
# find and extract a suspicious file:
python3 vol.py -f memory.raw windows.filescan | grep -i "evil.exe"
python3 vol.py -f memory.raw -o out/ windows.dumpfiles --virtaddr 0x...

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.