Memory Forensics Cheatsheet: Volatility 3 Rapid Triage

Prerequisites

• Volatility 3 installed: pip3 install volatility3
• A memory dump file (captured with DumpIt, WinPMEM, LiME, or similar)
• Basic command line familiarity
• Python 3.7+

Why Volatility 3?

Volatility 3 is a complete rewrite that's faster and supports unified analysis across Windows, Linux, and macOS. Unlike Vol2, you don't need to specify profiles manually—symbol tables are auto-detected.

Quick Start: Verify Your Dump

First, confirm Volatility can read your memory image:

bash copy
vol3 -f memory.dmp windows.info

This identifies the OS version, kernel base, and timestamp. Output shows something like:

code copy
Variable        Value
Kernel Base     0xf80078000000
DTB             0x1aa000
Symbols         ntkrnlmp.pdb

If this fails, your dump may be corrupted or you need symbol files (see Volatility docs).

Step 1: Identify Running Processes (First Look)

Get the process list to spot suspicious activity:

bash copy
vol3 -f memory.dmp windows.pslist

Look for:

• Unexpected parent-child relationships (e.g., cmd.exe spawned by winword.exe)
• Processes running from temp directories
• Misspelled system processes (scvhost.exe instead of svchost.exe)
• Multiple instances of processes that should be singular

For tree view showing process hierarchy:

bash copy
vol3 -f memory.dmp windows.pstree

Step 2: Detect Hidden/Unlinked Processes

Rootkits often hide processes. Cross-reference scanning methods:

bash copy
vol3 -f memory.dmp windows.psscan

Compare psscan output with pslist. Anything in psscan but not pslist was unlinked from the process list—a major red flag.

Step 3: Extract Network Connections

See active and recent network activity:

bash copy
vol3 -f memory.dmp windows.netstat

Key indicators of compromise:

• Connections to foreign IPs on unusual ports
• Local processes communicating on ports like 4444, 5555 (common backdoor ports)
• System processes with network connections (e.g., lsass.exe shouldn't talk to the internet)

For older Windows versions, use:

bash copy
vol3 -f memory.dmp windows.netscan

Step 4: Timeline Suspicious Process Activity

Check what commands were executed:

bash copy
vol3 -f memory.dmp windows.cmdline

This shows command-line arguments for each process. Look for:

• Encoded PowerShell (-enc, -e)
• Downloads (wget, Invoke-WebRequest)
• Credential dumping tools (mimikatz, procdump)
• Lateral movement (psexec, WMI commands)

Step 5: Dump Suspicious Process Memory

If PID 1337 looks suspicious, dump it for deeper analysis:

bash copy
vol3 -f memory.dmp windows.memmap --pid 1337 --dump

This creates a pid.1337.dmp file. Scan it with YARA, strings, or load into a debugger:

bash copy
strings pid.1337.dmp | grep -i "password\|token\|secret"

Step 6: Extract Loaded DLLs and Code Injection

See what DLLs each process loaded:

bash copy
vol3 -f memory.dmp windows.dlllist --pid 1337

Look for:

• DLLs loaded from temp or user directories
• Unexpected DLLs in system processes
• Missing or suspicious digital signatures

Detect code injection across processes:

bash copy
vol3 -f memory.dmp windows.malfind

This finds private, executable memory regions (common in process hollowing and reflective DLL injection). It shows:

• PID and process name
• Memory protection (PAGE_EXECUTE_READWRITE is suspicious)
• Hex dump of the injected code

Step 7: Registry Analysis for Persistence

Check common persistence registry keys:

bash copy
vol3 -f memory.dmp windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run"

Autostart locations to examine:

• \CurrentVersion\Run
• \CurrentVersion\RunOnce
• \Windows\CurrentVersion\Explorer\Shell Folders
• Services key

Step 8: Scan for Known Malware with YARA

Run YARA rules against all process memory:

bash copy
vol3 -f memory.dmp windows.vadyarascan --yara-file /path/to/malware_rules.yar

This scans Virtual Address Descriptors (VADs) and reports matches with:

• Process name and PID
• Rule name that triggered
• Virtual address of the match

Step 9: File Extraction

List files in memory (from cache):

bash copy
vol3 -f memory.dmp windows.filescan

Dump a specific file by its virtual address:

bash copy
vol3 -f memory.dmp windows.dumpfiles --virtaddr 0x1234567890

Useful for extracting dropped malware, documents, or scripts.

Step 10: Export Timeline for SIEM

Create a comprehensive timeline:

bash copy
vol3 -f memory.dmp timeliner --create-bodyfile > timeline.body

Convert to human-readable format with mactime:

bash copy
mactime -b timeline.body -d > timeline.csv

Import this CSV into your SIEM or Splunk for correlation with other log sources.

Triage Checklist (First 30 Minutes)

1. ✅ Run windows.info - confirm dump integrity
2. ✅ Run windows.pslist and windows.pstree - map process landscape
3. ✅ Run windows.psscan - find hidden processes
4. ✅ Run windows.netstat - identify network IOCs
5. ✅ Run windows.cmdline - check for suspicious commands
6. ✅ Run windows.malfind - detect code injection
7. ✅ Run YARA scan - match known malware signatures
8. ✅ Dump suspicious PIDs for deeper analysis

Where to Go Next

• Learn Linux/Mac analysis: Volatility 3 supports linux.pslist, mac.netstat, etc.
• Master symbol tables: Download Windows symbols from Microsoft Symbol Server for better analysis
• Build custom plugins: Volatility 3's Python framework lets you write plugins for specific artifacts
• Study the source: https://github.com/volatilityfoundation/volatility3
• Practice with CTFs: Try memory forensics challenges on CyberDefenders or HackTheBox
• Read "The Art of Memory Forensics": Comprehensive book covering advanced techniques

Memory forensics reveals what disk forensics can't—active malware, decrypted data, and runtime behavior. Master this skillset and you'll uncover evidence attackers thought they erased.