agentskillexchange Analyze memory images for processes, modules, and malware indicators with Volatility 3
Inspect captured RAM images to enumerate processes, modules, handles, and suspicious in-memory behavior before escalation or evidence handoff.
Prerequisites
Volatility 3 CLI, Python 3.8+ environment, supported memory image file, optional symbol packs depending on target OS
Installation
Use the upstream install or setup path that matches your environment:
- pip install --user -e ".[full]"
- pip install volatility3
- git clone https://github.com/volatilityfoundation/volatility3.git
- pip install -e ".[dev]"
Requirements and caveats from upstream:
- Some also require/accept other options. Run vol -h for more information on a particular command.
- Volatility 3 requires Python 3.8.0 or later and is published on the PyPi registry.
- Important: The first run of volatility with new symbol files will require the cache to be updated. The symbol packs contain a large number of symbol files and so may take some time to update!
Basic usage or getting-started notes:
Install the required dependencies:
shell
See available options:
Extracted from upstream docs: https://raw.githubusercontent.com/volatilityfoundation/volatility3/HEAD/README.md