Volatility

Volatility: Open Source Memory Forensics Framework

An open source framework for extracting digital artifacts from volatile memory (RAM) samples, aiding in malware investigation and system crash analysis.

What is Volatility?

Volatility is an advanced open source memory forensics framework used to analyze volatile memory (RAM) samples, usually obtained from endpoint systems as memory dumps or snapshots. It provides tools to extract digital artifacts from RAM that can reveal valuable forensic evidence.

Volatility supports analysis of memory captures from all major desktop and server versions of Windows, Linux, macOS, and Android systems. Its modular architecture allows easy extension with new plugins and profiles as new malware variants and OS versions emerge.

Key features provided by Volatility include viewing details of running processes, loaded DLLs modules and open network connections, extracting executable files and registry hives for malware analysis, detecting hidden processes being run by rootkits, analyzing the Windows kernel for signs of compromise, and automating analysis at scale across a fleet of systems.

Volatility is used worldwide by incident responders, security engineers, and forensics investigators to analyze endpoint memory during malware infections, targeted intrusions, or after suspicious system crashes. It can uncover forensic evidence that may not be accessible once the endpoint is powered down. The insights it provides are invaluable for understanding the full scope and impact of a security incident.

Volatility Features

Official Links