---
# System prepended metadata

title: Volatility CheatSheet - Windows Memory Dump Analysis - Forensic
tags: [CheatSheet, Forensic, Volatility]

---

---
title: 'Volatility CheatSheet - Windows Memory Dump Analysis - Forensic'
---

![Volatility](https://avatars.githubusercontent.com/u/6001145)
[Volatility Foundation](https://github.com/volatilityfoundation/)

Volatility CheatSheet - Windows memdump
===

## OS Information
**imageinfo**
> Volatility 2
```
vol.py -f "filename" imageinfo
vol.py -f "filename" kdbgscan
```

> Volatility 3
```
vol3 -f "filename" windows.info
```

## Process Information
**process list**
> Volatility 2
```
vol.py -f "filename" ‑‑profile <profile> pslist
vol.py -f "filename" ‑‑profile <profile> psscan
vol.py -f "filename" ‑‑profile <profile> pstree
vol.py -f "filename" ‑‑profile <profile> psxview
```

> Volatility 3
```
vol3 -f "filename"  windows.pslist
vol3 -f "filename"  windows.psscan
vol3 -f "filename"  windows.pstree
```

**procdump**
> Volatility 2
```
vol.py -f "filename" ‑‑profile <profile> procdump -p <PID> ‑‑dump-dir="output/dir"
```

> Volatility 3
```
vol3 -f "filename" -o "output/dir" windows.dumpfiles ‑‑pid <PID>
```

**memdump**
> Volatility 2
```
vol.py -f "filename" ‑‑profile <profile> memdump -p <PID> ‑‑dump-dir="output/dir"
```

> Volatility 3
```
vol3 -f "filename" -o "output/dir" windows.memmap ‑‑dump ‑‑pid <PID>
```

**handles**
> Volatility 2
```
vol.py -f "filename" ‑‑profile <profile> handles -p <PID>
```

> Volatility 3
```
vol3 -f "filename" windows.handles ‑‑pid <PID>
```

**dlls**
> Volatility 2
```
vol.py -f "filename" ‑‑profile <profile> dlllist -p <PID>
```

> Volatility 3
```
vol3 -f "filename" windows.dlllist ‑‑pid <PID>
```

**cmdline**
> Volatility 2
```
vol.py -f "filename" ‑‑profile <profile> netscan
vol.py -f "filename" ‑‑profile <profile> netstat

XP/2003 SPECIFIC

vol.py -f "filename" ‑‑profile <profile> connscan
vol.py -f "filename" ‑‑profile <profile> connections
vol.py -f "filename" ‑‑profile <profile> sockscan
vol.py -f "filename" ‑‑profile <profile> sockets
```


> Volatility 3
```
vol3 -f "filename" windows.netscan
vol3 -f "filename" windows.netstat
```

## Network Information
**netscan**
> Volatility 2
```
vol.py -f "filename" ‑‑profile <profile> dlllist -p <PID>
```

> Volatility 3
```
vol3 -f "filename" windows.dlllist ‑‑pid <PID>
```

## Registry
**hivelist**
> Volatility 2
```
vol.py -f "filename" ‑‑profile <profile> hivescan
vol.py -f "filename" ‑‑profile <profile> hivelist
```

> Volatility 3
```
vol3 -f "filename" windows.registry.hivescan
vol3 -f "filename" windows.registry.hivelist
```

**printkey**
> Volatility 2
```
vol.py -f "filename" ‑‑profile <profile> printkey
vol.py -f "filename" ‑‑profile <profile> printkey -K “Software\Microsoft\Windows\CurrentVersion”
```

> Volatility 3
```
vol3 -f "filename" windows.registry.printkey
vol3 -f "filename" windows.registry.printkey ‑‑key “Software\Microsoft\Windows\CurrentVersion”
```

**hivedump**
> Volatility 2
```
vol.py -f "filename" ‑‑profile <profile> hivedump -o <offset> 
```

> Volatility 3
```

```

## Files
**filescan**
> Volatility 2
```
vol.py -f "filename" ‑‑profile <profile> filescan
```

> Volatility 3
```
vol3 -f "filename" windows.filescan
```

**filedump**
> Volatility 2
```
vol.py -f "filename" ‑‑profile <profile> dumpfiles ‑‑dump-dir="output/dir"
vol.py -f "filename" ‑‑profile <profile> dumpfiles ‑‑dump-dir="output/dir" -Q <offset>
vol.py -f "filename" ‑‑profile <profile> dumpfiles ‑‑dump-dir="output/dir" -p <PID>
```

> Volatility 3
```
vol3 -f -o "output/dir"  "filename" windows.dumpfiles
vol3 -f -o "output/dir"  "filename" windows.dumpfiles ‑‑virtaddr <offset>
vol3 -f -o "output/dir"  "filename" windows.dumpfiles ‑‑physaddr <offset>
```

---
## Collection links (Toolkit & Profiles)
* [Volatility Plugins by superponible](https://github.com/superponible/volatility-plugins)
* [Volatility Plugins by siliconblade](https://github.com/siliconblade/volatility)
* [Volatility Plugins by Dutchy-](https://github.com/Dutchy-/volatility-plugins)
* [Volatility Plugins by kevthehermit](https://github.com/kevthehermit/volatility_plugins)
* [Volatility Plugins by jjo-sec](https://github.com/jjo-sec/volatility_plugins)
* [Volatility Plugins by INTECOCERT](https://github.com/INTECOCERT/volatility_plugins)
* [Volatility Plugins by carlpulley](https://github.com/carlpulley/volatility)
* [Volatility Plugins by TakahiroHaruyama](https://github.com/TakahiroHaruyama/openioc_scan)
* [Volatility Plugins by ymh1989](https://github.com/ymh1989/SABR_local_vol)
* [Volatility Plugins by monnappa22](https://github.com/monnappa22/linux_mem_diff_tool)
* [AutoVolatility](https://github.com/carlospolop/autoVolatility)
* [Volatility Workbench](https://www.osforensics.com/tools/volatility-workbench.html)
* [VolUtility](https://github.com/kevthehermit/VolUtility)
* [VolatilityBot](https://github.com/mkorman90/VolatilityBot)
* [Volatility profiles for Linux and Mac OS X](https://github.com/volatilityfoundation/profiles)
* [MalConfScan](https://github.com/JPCERTCC/MalConfScan)
* [VolDiff](https://github.com/H2Cyber/VolDiff)
* [bitlocker plugin](https://github.com/tribalchicken/volatility-bitlocker)
* [Malhunt](https://github.com/andreafortuna/malhunt)
* [Chrome Ragamuffin](https://github.com/cube0x8/ChromeRagamuffin)
* [Volatility 3 Symbol table packs Windows (volatility3/volatility/symbols)](https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip)
* [Volatility 3 Symbol table packs Linux (volatility3/volatility/symbols)](https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip)
* [Volatility 3 Symbol table packs Mac (volatility3/volatility/symbols)](https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip)
* []()

---
## Sources
* [Comparing commands from Vol2 > Vol3](https://blog.onfvp.com/post/volatility-cheatsheet/)
* [Andrea Fortuna](https://andreafortuna.org/2017/06/25/volatility-my-own-cheatsheet-part-1-image-identification/)
* [Basic Forensic Methodology > Memory Dump Analysis](https://book.hacktricks.xyz/generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet)
* [Volatility Command Reference](https://github.com/volatilityfoundation/volatility/wiki/Command-Reference)
* [Memory forensics and analysis using volatility](https://resources.infosecinstitute.com/topic/memory-forensics-and-analysis-using-volatility/)
* [Tutorial - Volatility plugins & malware analysis](http://tomchop.me/2016/11/21/tutorial-volatility-plugins-malware-analysis/)

###### tags: `Volatility` `CheatSheet` `Forensic`