Memory Forensics with Volatility

What a memory dump is

A memory dump (.raw, .mem, .vmem, .lime) is a byte-for-byte snapshot of a running computer’s RAM. It contains running processes, open files, network connections, decrypted data, and sometimes credentials and flags.

Identify the OS first

python3 vol.py -f memory.raw windows.info   # Windows
python3 vol.py -f memory.raw linux.bash     # Linux (needs profile)

Volatility 3 auto-detects the OS. Volatility 2 needs a --profile flag.

Core plugins

# Running processes
python3 vol.py -f memory.raw windows.pslist
python3 vol.py -f memory.raw windows.pstree     # parent-child hierarchy

# Network connections
python3 vol.py -f memory.raw windows.netscan

# Command history
python3 vol.py -f memory.raw windows.cmdline    # each process's command line
python3 vol.py -f memory.raw windows.consoles   # typed commands

# Files
python3 vol.py -f memory.raw windows.filescan   # all file objects in memory
python3 vol.py -f memory.raw windows.dumpfiles --virtaddr 0xADDR  # extract one

# Registry
python3 vol.py -f memory.raw windows.registry.hivelist
python3 vol.py -f memory.raw windows.registry.printkey --key "Software\Microsoft"

# Hashes
python3 vol.py -f memory.raw windows.hashdump   # SAM hashes → crack offline

CTF workflow

1. pslist — identify suspicious processes (notepad, powershell, something unusual).
2. cmdline on suspicious PIDs — what did they run?
3. netscan — was there an outbound connection to an unusual IP?
4. filescan | grep flag — is a flag file open in memory?
5. dumpfiles to extract it.

Extracting strings from a process

python3 vol.py -f memory.raw windows.memmap --pid 1234 --dump
strings pid.1234.dmp | grep -i flag