Introduction to Memory Forensics with Volatility 3

Volatility is a very powerful memory forensics tool. It is used to extract information from memory images (memory dumps) of Windows, macOS, and Linux systems. There is also a huge community writing third-party plugins for volatility. You definitely want to include memory acquisition and analysis in your investigations, and volatility should be in your forensic toolkit.
Today we show how to use Volatility 3 from installation to basic commands. When analyzing memory, basic tasks include listing processes, checking network connections, extracting files, and conducting a basic Windows Registry analysis. We cover each of these tasks. After you understand the Volatility 3 command structure and extract some basic information, advanced memory analysis just builds on those concepts.
Thank you to our Members and Patrons, but especially to our Investigators, TheRantingGeek, Roman, and Alexis Brignoni! Thank you so much!
Memory analysis - with the help of volatility 3 - is becoming easier. It is an excellent source of action-related evidence. If you are not already routinely including memory acquisitions in your investigations, I strongly recommend you do. The amount of information available that will never be written to disk is well worth the extra effort.
00:00 Introduction to Volatility 3
00:27 Install Volatility 3 on Windows
04:49 Volatility first run check
05:49 Find the path of your target memory image
06:09 Get RAM image info with windows.info
07:35 Listing installed plugins
09:07 Get process list from RAM with windows.pslist
12:09 Filter Volatility output with PowerShell Select-String
13:55 Find process handles with windows.handles
16:52 Dump a specific file from RAm with windows.dumpfile
19:26 Dump all files related to a PID
20:12 Check executable run options with windows.cmdline
21:49 Find active network connections with windows.netstat
23:49 Find local user password hash with windows.hashdump
24:43 Analyze user actions with windows.registry.userassist
27:09 Find and dump Registry hives from RAM with windows.registry.hivelist
28:39 Analyze a specific Registry key from RAM with windows.registry.printkey
30:18 Intro to Volatility 3 review
🚀 Full Digital Forensic Courses → learn.dfir.science
Links:
* Python: python.org (get version 3)
* Git for Windows: gitforwindows.org/
* Microsoft C++ Build Tools: visualstudio.microsoft.com/vi...
* Python Snappy: www.lfd.uci.edu/~gohlke/pytho...
* Volatility 3: github.com/volatilityfoundati...
* Practice memory image: archive.org/details/Africa-DF...
Volatility Community: www.volatilityfoundation.org/
Related books:
* The Art of Memory Forensics (amzn.to/33DTt9b)
#volatility #forensic #memory #analysis
010001000100011001010011011000110110100101100101011011100110001101100101
Get more Digital Forensic Science
👍 Subscribe → bit.ly/2Ij9Ojc
❤️ YT Member → bit.ly/DFIRSciMember
❤️ Patreon → / dfirscience
🕸️ Blog → DFIR.Science
🤖 Code → github.com/DFIRScience
🐦 Follow → / dfirscience
📰 DFIR Newsletter → bit.ly/DFIRNews
010100110111010101100010011100110110001101110010011010010110001001100101
Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. Please link back to the original video. If you want to use this video for commercial purposes, please contact us first. We would love to see what you are doing.

[@silvertechnolo3958]

Just started learning memory forensics with "The Art of Memory Forensics" and wanted a nice little video to supplement my learning. So glad you're here 🤗 thanks a lot

[@DFIRScience]

That's a great book! Let me know if you if you have any questions. Thank you!

[@frooogle99]

Thank you! This video has been the best resource so far!! Much appreciate it man! 😊

[@DFIRScience]

Glad it was helpful!

[@MrBitviper]

awesome tutorial. this is very informative and easy to understand thank you so much for this

[@djnikx1]

👍Excellent presentation. Thank you!

[@kerryhazelton5977]

Good stuff as usual!

[@dead_gawk]

Really enjoyed the class :)

[@fianvar]

Thanks a lot. Very useful this explaining.

[@yastazik1982]

Very informative with great tips thanks 🙏🏻

[@DFIRScience]

Glad it was helpful!

[@genesistorrico343]

thanks for the video! it was a great help

[@DFIRScience]

Glad it helped!

[@andreelyusef3235]

Bro you rock! I am subscribing

[@andrevm9410]

Great video!

[@DFIRScience]

Thanks a lot!

[@juansanchez6685]

Great Video!

[@DFIRScience]

Thanks! Hope it was helpful!

[@zerocool4580]

Excellent Video and thank you. The only thing I would add is, when I was trying to point Volatility to the .raw memory file I was receiving errors for permissions and so on. I then placed the .raw file in the same folder as the Volatility3 and it finally worked. Just in case others run into this issue.

[@sruthisivaraman2290]

hey there. I would like to know what to do if the translation requirement and symbol table requirement are not fulfilled while listing installed plugins?

[@nemzyxt]

Awesome, new sub here, thanks a lot

[@alfonzo7822]

I just wrote a massive post then lost it.. my pc then subsequently my network got compromised back in June. Clean install did nothing. Microsoft, HP and bitdefender say that since all virus scans are clear and system has been reinstalled that it's fine. It's taken me literally months to get to the point where I have a good idea what is going on but still can't resolve it. Have seen boot files on wireshark from specific ips, my winRE is empty so concluded it must be a pxe boot. Sure enough managed to locate relevant files. However need more info to be able to work out safe removal as so far anything I do hasn't worked. Ran a massive memory dump and tried to use volatility but yeh couldn't get it going properly. However this vid has helped a lot and fingers crossed I'll find the treasure :) thanks a lot for uploading this!

[@Dxxxxxk]

Thank you

[@sruthisivaraman2290]

Hi thanks for the video. I would like to know what to do if the translation requirement and symbol table requirement are not fulfilled while listing installed plugins?

[@nk8681]

Thanks for this informative but extremely important video for those who need to give a start . There is a request, Can you make a video on Network Artifacts for Linux Memory Forensics, I will be grateful to you, Thanks in advanced.

[@TheDarkMEXiCaN2020]

Can you make a follow up on the issues setting up when you are installing Microsoft tools? Maybe show us what we actually need?

[@carlosdanielbedoyramos4419]

hello, will you have a video analyzing the ram memory of a linux with volatility3?

[@billbenhaim5332]

Hi, thanks for that video, I really want to replicate that memory dump by myself - On which windows 10x64 OS build have you used? and do you which windows 10 os builds are supported by the volatility version that you have used in the video?

[@DFIRScience]

It was Windows 10 but the build was from about a year ago. You should get the same results with newer builds of Windows 10 and an updated version of Volatility. Use FTK Imager or Magnet RAM capture on Win10 and you should get what you need. Let me know if you don't get the same results!

[@sruthisivaraman2290]

Hey there. I would like to know what to do if the translation requirement and symbol table requirement are not fulfilled while listing installed plugins?

[@user-ne8hc3xf3d]

volatility 2.6 didn't work for WIn10 memory, but now i gonna use volatility 3. Really helpful video! Thanks. And could I write those processes in my blog with citation? If you say "NO", I'll just memorize in my head.

[@DFIRScience]

Take a look at dfir.science/2022/02/Introduction-to-Memory-Forensics-with-Volatility-3 The commands are listed under the video. But, yeah, if you want to put it in your blog, it's all good.

[@sruthisivaraman2290]

I would like to know what to do if the translation requirement and symbol table requirement are not fulfilled while listing installed plugins?

[@DaFunkyFRO]

Great video. Unfortunately hashdump and netstat don't seem to appear in the 2.4.0 framework (the latest pulled as of this posting)

[@vtrhbr]

hey how did you end up using hashmap?

[@bartkor1220]

yeah I tried using windows.netstat but it just errored

[@vtrhbr]

@@bartkor1220 Yes, stop using this piece of software :D

[@adamgrumpy87]

Do you have to install all the C++ build tools or only the core ones?

[@DFIRScience]

I believe core only would work.

[@liveyourlifeplease]

Has anyone came across with the idea of creating aliases for volatility plugins, so we make the command line cleaner? --btw great video, thank you

[@shreyaskumar3091]

Hey there! Amazing video, but I got stuck at the part of the ACTF.mem file. I could not figure out from where to get that file. Kindly help.

[@fernandoalvaradomiranda9685]

Hey, how are you, just a question, how do i know my correct version of windows to download snappy?

[@0galeicrum]

Hi, I have a question, 28:25 I have my .hive file, but it's a bit confusing using the hex reader, I'm using kali, is there an alternative to analyse this file?

[@sruthisivaraman2290]

hey there. I would like to know what to do if the translation requirement and symbol table requirement are not fulfilled while listing installed plugins?

[@Renglus]

For some reason, when doing the windows.handles nothing shows up at all, and when trying to dump a file, it just does a PDB scanning. I cannot find any answers to this problem on the internet

[@smithj7U]

I can't get the installation stuff to work. I know how to open the windows powershell in the try hack me attack room. So frustrating. video after video and I can't get volatility to be installed. 😞

[@CyDig]

I installed Volatility 3 in Windows 11, and it works great.

[@userewjonqk]

How should we know if there is malware in the field or in memory

[@JeffreyLaDouceur-wr3el]

The link is broken for Snappy, not sure where to go from there.

[@awakenerd1101]

What is the purpose of filtering chrome? Doe chrome make connections to malware servers? I don't think so.

[@rashmig2110]

I am unable to get windows.cachedump.Cachedump option in my volatility latest version.pls help

[@ikechukwuigbeka7743]

Please i have an issue , after installing volatility 3. I get this error everytime i try to run a command "volatility: error: Please select a plugin to run" how do i get past this?, Also Ive been unable to get the python snappy.

[@hammazahmed1289]

I was having problem with checking the python version. It was so trivial. It didn't work coz in windows I must also install python using Microsoft store.

[@stuna2754]

I don't see snappy v0.6.0 available at that link which is the required version for volatility3. is there another way to install snappy on windows?

[@DFIRScience]

It's about 75% of the way down. They have v0.6.1. Here is the link for Win AMD64: download.lfd.uci.edu/pythonlibs/archived/python_snappy-0.6.1-cp311-cp311-win_amd64.whl

[@stuna2754]

@@DFIRScience The requirementss.txt for Volatility3 says v0.6.0 so I'm not able to get it work with v0.6.1

[@aarishfakih741]

I am not able to install python snappy... it says wheel is not supported... What should I do now?

[@CyDig]

It is very simple to install and config

[@galloe]

@@CyDig So explain it to them, don't be a dick.

[@microlab3692]

✌

[@DFIRScience]

👍😆

[@segunoludare8713]

It appears python-snappy isn't allowing the installation of "requirements.txt". Any help?

[@DFIRScience]

You may need to download python-snappy and install it separately. I had the same trouble on Windows. pypi.org/project/python-snappy/

[@EvilSapphireR]

Is this eli the computer guy?

[@jasonmoore4429]

the easiest way to get python 3 to work with powershell goto the MS Store

[@DFIRScience]

I don't know why I didn't even consider MS Store. Thanks for that!

[@defnd3r]

It's okay to hit like before starting the video correct? Because that's what I do before I watch any of your videos.

[@DFIRScience]

Thank you so much! 😆

[@PiperUsmc]

lol just did the same thing

[@vivekpadman5248]

Can somebody provide a link for example dump files

[@CyDig]

You can create it by using FTK Imager or Magnet RAM Capture

[@user-jh6yv1wh9w]

I download "python_snappy-0.6.1-cp310-cp310-win_amd64.whl" and install using pip install. Power shell told me "python-snappy is already installed with the same version as the provided wheel. Use --force-reinstall to force an installation of the wheel." And I try "pip install -r . equirements.txt" but I got "ERROR: Failed building wheel for python-snappy". How to solve this problem??

[@DFIRScience]

Try pip uninstall python-snappy then reinstall from the downloaded whl. You should not need to compile.

[@user-jh6yv1wh9w]

@@DFIRScience I try "pip uninstall python-snappy" and get "Successfully uninstalled python-snappy-0.6.1" now I try again "pip install python_snappy-0.6.1-cp310-cp310-win_amd64.whl" and get "Successfully installed python-snappy-0.6.1" And try "pip install -r . equirements.txt" and get "ERROR: Failed building wheel for python-snappy". PowerShell told me "fatal error LNK1181: 'snappy.lib' can't open " Please help me . . . :(

[@DFIRScience]

@@user-jh6yv1wh9w Do you happen to have two versions of python installed? That could be the conflict. Try removing all version of python and installing the newest version (3.10.7) from www.python.org/

[@SoulJah876]

I don't seem to have hashdump - to the Googles.

[@SoulJah876]

One can always count on the Googles :D

[@DFIRScience]

Did you get the newest version of Volatility 3? (2.0.0+)? Did you find hashdump?

[@SoulJah876]

@@DFIRScience yeah I had to pip the full requirements and then reinstall. I had only done minimal before.

[@liszadarling]

I'm stuck at snappy. tried every single one for my laptop and none of them are supported. I've double-checked the build tools being installed correctly and it is. Power Shell is now saying volatility error: please select a plugin to run. How do I resolve this? I need to get volatility up and running for a project. Thanks!

[@midlifehemi88]

Did you ever figure this out? I'm trying to install Python Snappy as well and getting the same issue. Just says it isn't a supported .whl on this platform

[@breves]

Hi there and thanks for posting! How did you dump the ntuser.dat (25:21) ? cant seem to find an option for that and windows.dumpfiles does not take the hive offset...EDIT: I used windows.filescan, thanks anyway