Volatility 3 Memory Forensics Tutorial: Analyze a RAM Capture

Memory forensics is one of the highest-value skills in DFIR because RAM holds evidence that never hits disk: live processes, open network connections, decrypted data, and malware that runs only in memory. This tutorial walks through analyzing a Windows memory image with Volatility 3.

Why memory forensics?

When an incident happens, the volatile state of a machine - what was running, what it was talking to - is often the clearest record of attacker activity. Capture and analyze it before it is gone.

Step 1 - Install Volatility 3

Volatility 3 is a Python framework. Install it from source:

git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
pip install -e .

Confirm it runs with vol -h. Unlike Volatility 2, version 3 does not require you to specify a profile - it identifies the OS from symbol tables automatically.

Step 2 - Confirm the image

Always work on a copy of the capture. Start by validating it:

vol -f memory.raw windows.info

This confirms the OS build and that the image is readable before you go further.

Step 3 - List processes

The first investigative question is always "what was running?"

vol -f memory.raw windows.pslist
vol -f memory.raw windows.pstree

windows.pslist gives a flat list; windows.pstree shows parent-child relationships, which is where suspicious chains stand out - for example a Word process spawning a command shell.

Step 4 - Hunt hidden processes

Malware often unlinks itself from the standard process list. Cross-check it:

vol -f memory.raw windows.psscan

Compare psscan (which scans memory for process structures) against pslist. A process that appears in one but not the other is a red flag.

Step 5 - Network connections

Find what the host was communicating with:

vol -f memory.raw windows.netscan

Unexpected outbound connections to unfamiliar IP addresses are a classic indicator of command-and-control activity.

Step 6 - Find injected code

windows.malfind looks for memory regions with execute permissions that are not backed by a file on disk - a common signature of process injection:

vol -f memory.raw windows.malfind

Pair it with windows.cmdline to see the arguments processes were launched with.

Step 7 - Document everything

Forensics is only useful if it is defensible. Record every command, its output, and your reasoning as you go, so your findings can be reproduced and stand up to scrutiny.

Practice on a real image

Reading the commands is not the same as running them. On Purple Edge you can work through a real Windows memory capture in a guided DFIR lab and find the evidence yourself.