volatility

List available plugins and profiles

$ volatility --info

$ volatility -f [memory.img] --profile=[LinuxProfile] linux_pslist

$ volatility -f [memory.img] --profile=[Profile] linux_netstat

$ volatility -f [memory.img] --profile=[Profile] linux_bash

$ volatility -f [memory.img] --profile=[Profile] linux_lsof

$ volatility -f [memory.img] --profile=[Profile] linux_cmdline

$ volatility -f [memory.img] --profile=[Profile] linux_yarascan -y [rules.yar]

volatility -f memoryimage [--profile=PROFILE] plugin [options_]
vol.py -f memoryimage plugin_

volatility is an open-source memory forensics framework for extracting digital artifacts from RAM dumps. It analyzes memory images to recover running processes, network connections, command history, and other volatile data not available on disk.
The framework supports Windows, Linux, and macOS memory analysis. Linux plugins are prefixed with linux_ and require a profile matching the exact distribution, kernel version, and architecture of the system that created the dump.
Volatility 3 simplifies profile management with automatic symbol detection, while Volatility 2 requires manually building or obtaining profiles. Memory dumps can be acquired using tools like LiME (Linux Memory Extractor) or VMware snapshots.

-f FILE, --file FILE

Memory image file to analyze

Operating system profile (required for Volatility 2)

List available plugins and profiles

Enable debug output

Show help message

Filter by process ID

Physical offset in memory

Output format (text, json, html)

Write output to file

linux_pslist

List running processes

Process tree view

Recover bash command history

Show network connections

List open file descriptors

Show process command-line arguments

List mounted filesystems

Find files in memory

Scan memory with Yara rules

Dump loaded kernel modules

Show process memory maps

Linux analysis requires a profile matching the exact kernel version and distribution. Building profiles requires kernel headers and debug symbols. Memory images are large and analysis can be resource-intensive. Anti-forensic techniques may interfere with some plugins. Not all plugins work on all memory formats.

The Volatility Framework was created by Aaron Walters and first released in 2007. It emerged from academic research into memory forensics at George Mason University. The project became the standard tool for memory analysis in digital forensics and incident response. Volatility 3, released in 2019, introduced Python 3 support and automatic symbol table generation, simplifying Linux and macOS analysis.

lime(1), strings(1), file(1), dd(1)