🛠️ Volatility 3

Installation

python3 -m venv ~/vol3 && source ~/vol3/bin/activate
pip install volatility3
# entry point is `vol` (or `python3 -m volatility3`)

Common Commands

Every invocation is vol -f <image> <plugin>; plugins are namespaced by OS (windows.*, linux.*, mac.*). Raw memory images (.vmem, .raw, .dmp, .lime) are read directly — no conversion, no profile to pick (v3 resolves symbols itself, unlike v2).

Command	Description
vol -f mem.vmem windows.info	Identify the image: OS build, architecture, KDBG — always the first command, and the sanity check that the file is actually a usable memory dump.
vol -f mem.vmem -o out/ windows.registry.hivelist.HiveList --dump	List every registry hive resident in memory and carve each one to disk — this is how you get SAM/SYSTEM/SECURITY out for offline Impacket secretsdump.
vol -f mem.vmem windows.hashdump	Local account NT hashes, straight from the image.
vol -f mem.vmem windows.lsadump	LSA secrets (service account passwords, DPAPI material, auto-logon credentials).
vol -f mem.vmem windows.cachedump	Cached domain credentials (DCC2) for users who logged on to the host.
vol -f mem.vmem windows.pslist / windows.pstree	Running processes, flat or as a parent/child tree.
vol -f mem.vmem windows.cmdline	Full command line of every process — where tokens and passwords passed as arguments show up.
vol -f mem.vmem windows.netscan	Network connections and listening sockets at snapshot time.
vol -f mem.vmem windows.filescan	Every file object in memory; feed an offset to windows.dumpfiles --virtaddr <offset> to recover the file itself.
vol -f mem.vmem windows.memmap --pid <pid> --dump	Dump one process’s memory (e.g. lsass.exe, then run it through pypykatz).
vol -f mem.vmem windows.malfind	Injected/unbacked executable memory regions.
vol -f mem.vmem linux.bash	Recover bash history from a Linux image.

Tips & Tricks

• -o <dir> sets the output directory for anything with --dump — set it explicitly, otherwise carved hives and files land in the current directory mixed together.
• Dumped hives are named by memory address (registry.SAM.0xc30a3278e000.hive), so pick them out with ls -la out/ | grep -E 'SAM|SYSTEM|SECURITY' rather than guessing.
• windows.hashdump/lsadump sometimes fail on newer Windows builds where the crypto changed; carving the hives and using impacket-secretsdump ... LOCAL is the more reliable path and gives the same result — see Memory Forensics - Windows Credential Extraction from VM Snapshots.
• Symbol tables are downloaded on first use for the exact kernel build; on an offline box, pre-fetch the symbol packs or every Windows plugin will fail with a symbol error.
• VMware .vmem is raw guest RAM and works as-is; Hyper-V/VirtualBox saved states need converting first (vmss2core, vboxmanage debugvm dumpvmcore).
• Volatility 3 dropped the v2 --profile flag entirely — old write-ups full of --profile=Win7SP1x64 are v2 syntax and will not translate.

Related Usage

File	Created
HTB Machine - Checkpoint	Thursday, September 3rd 2026, 9:04:16 pm

---

References: Volatility 3 documentation