Introduction

Revision History

Date	Author	Summary
19-MAR-2026	CW2 Bernadotte	Initial markdown draft — covers Vol2 and Vol3; process analysis, malware detection, carving, network, registry, credentials

Purpose

The purpose of this aid is to provide technique-focused guidance for memory forensics using Volatility 2 and Volatility 3. Each section covers a specific analytical objective (process analysis, malware detection, data carving, etc.) with both tool versions documented so analysts can work with either version depending on what is available and the target OS.

End-State

Analysts can determine the correct Volatility 2 profile or confirm Volatility 3 symbol availability for a given memory image.
Analysts can perform process, network, registry, and artifact analysis from a memory image.
Analysts can detect common memory-resident malware techniques (injection, hollowing, rootkits).
Analysts can extract files, processes, DLLs, registry hives, and credentials from a memory image.

Requirements

A memory image file (.raw, .vmem, .mem, .dmp, .lime, etc.).
Volatility 2: Python 2.7, vol.py — typically installed at /usr/bin/vol.py or /opt/volatility/vol.py.
Volatility 3: Python 3.6+, vol3 or python3 vol.py — typically installed at /opt/volatility3/vol.py or via pip.
Sufficient disk space for output — full process memdumps can be hundreds of MB each.

Volatility 2 vs Volatility 3

Aspect	Volatility 2	Volatility 3
Python	Python 2.7	Python 3.6+
Profile	Required (`--profile=Win10x64_19041`)	Not required — auto-detects via symbol tables
Plugin syntax	`vol.py -f image --profile=X pslist`	`vol3 -f image windows.pslist`
Plugin namespace	Flat (`pslist`, `malfind`)	Namespaced (`windows.pslist`, `linux.pslist`)
Symbol tables	Embedded profiles	ISF symbol files (auto-downloaded or manual)
Windows 10/11	Limited — profile must match exact build	Preferred — handles modern OS well
Older OS (XP, Vista)	Better coverage	Limited plugin support
Output format	Human-readable text	Structured (tab-separated); use `-r pretty` for readable output
Extraction (`-D`)	`-D <output_dir>`	`--dump` (outputs to current directory)

Which Version to Use

Use Vol3 for Windows 8.1 and newer (especially Windows 10/11). Use Vol2 for Windows XP, Vista, and 7 where profiles are well-tested, or when a specific Vol2-only plugin is needed.

Determining the Profile (Vol2 Only)

Before running any Vol2 plugin, identify the correct profile for the image:

# Recommended first — faster and more reliable on modern OS
vol.py -f <image> kdbgscan

# Alternative — slower, may give multiple suggestions
vol.py -f <image> imageinfo

Use the Suggested Profile(s) from the output. If multiple are listed, try the first — if results look wrong (garbled process names, etc.) try the next.

Vol3 Skips This Step

Vol3 automatically determines the OS version and downloads the appropriate symbol table on first use. Run vol3 -f <image> windows.info to confirm successful symbol resolution and see OS details.

Common Command Structure

# Volatility 2
vol.py -f <memory_image> --profile=<profile> <plugin> [options]

# Examples
vol.py -f /cases/image.raw --profile=Win10x64_19041 pslist
vol.py -f /cases/image.raw --profile=Win10x64_19041 malfind -p 1234 -D /cases/output/

# Volatility 3
vol3 -f <memory_image> <namespace>.<plugin> [options]

# Examples
vol3 -f /cases/image.raw windows.pslist
vol3 -f /cases/image.raw windows.malfind --pid 1234
vol3 -f /cases/image.raw windows.dumpfiles --virtaddr 0xhexaddr

Readable Vol3 Output

Vol3 outputs tab-separated text by default. For a clean human-readable format:

vol3 -r pretty -f <image> windows.pslist

Revision History​

Purpose​

End-State​

Requirements​

Volatility 2 vs Volatility 3​

Determining the Profile (Vol2 Only)​

Common Command Structure​