What problem does it solve? Investigating compromised systems requires analyzing volatile memory that disk forensics cannot capture, and analysts need structured guidance for acquiring RAM captures and extracting forensic artifacts from them. ## Core Features & Use Cases - Memory Acquisition: Capture RAM on Windows (WinPmem, DumpIt), Linux (LiME, /proc/kcore), macOS (osxpmem), and virtual machines (VMware, VirtualBox, QEMU). - Volatility 3 Analysis: Run plugins for process listing, network connections, DLL injection detection (malfind), registry hives, and credential extraction across Windows, Linux, and macOS dumps. - Malware & Rootkit Detection: Identify process injection, hidden processes via psscan/pslist comparison, DKOM manipulation, and hook detection, plus YARA scanning of memory regions. - Use Case: During incident response, acquire a memory dump from a suspect Windows host, run windows.pstree and windows.malfind to spot injected code, then dump the malicious process and scan it with YARA rules. ## Quick Start Analyze the memory dump memory.raw with Volatility 3 to list processes, detect code injection, and extract network connections.
