MalwareIncident Response & Malware AnalysisMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.The Volatility Foundation
Volatility 3
Volatility 3 reads a memory image and rebuilds what the operating system knew at the moment of capture: processes, connections, loaded modules, handles and code that never touched the disk. It replaced Volatility 2, which is now archived.
FrameworkOpen sourceCurrent
Profile
- Manufacturer
- The Volatility Foundation
- Category
- Memory and malware
- Product type
- Framework
- Platforms
- Not stated by the manufacturer
- Licensing
- Open source
- Product status
- Current
- Educational level
- Advanced
- Last verified
- 2 November 2026
Volatility 2 (the volatility repository on GitHub) was archived on 16 May 2025 and is read-only; its README points to Volatility 3. Release 2.28.2 of Volatility 3 (September 2026) was current when checked and its notes mark macOS analysis support as deprecated. The foundation publishes no platform list. The framework needs Python 3.8 or later and a Windows executable is also provided.
What Volatility 3 is
The Volatility Foundation is an independent non-profit that maintains the framework and releases it under the Volatility Software License version 1.0. Volatility 3 is written for Python 3.8 or later and is a rewrite of Volatility 2, which had grown around Python 2 and hand-made profiles. The old repository was archived on GitHub on 16 May 2025 and is read-only, with a README that points to Volatility 3. The new framework uses symbol tables instead of profiles. Windows symbol tables are downloaded automatically as needed, while Linux and macOS tables are produced by the examiner with dwarf2json for the exact kernel involved. Plugins are named by operating system and task, such as windows.pslist or linux.pslist. At the time of checking the current release was 2.28.2 of September 2026, whose notes mark macOS analysis support as deprecated.
Volatility does not capture memory. The image comes from another tool, such as FTK Imager or Magnet's acquisition tools on Windows, and Volatility then reads it offline. The usual path on a Windows image is to identify the system with windows.info, list processes with pslist and pstree, look for hidden ones with psscan, read network connections with netscan, find injected or unbacked code with malfind and dump files or process memory for further examination. Results are tables that can be rendered as text, CSV or JSON and compared with disk evidence. This is how examiners find malware that lives only in memory. It is also how they recover encryption keys and command lines and show which program held which file open. A memory image is a snapshot taken while the system was changing, so some structures will be inconsistent and the report must say so.
Primary applications
Where it is used
- Listing running and hidden processes, their parents and command lines
- Recovering network connections present at capture time
- Finding injected code and unbacked executable memory
- Extracting files, registry hives and process memory for further analysis
- Recovering credentials, keys and command history where lawfully required
- Analysing Linux systems with custom symbol tables
Who uses it
- Incident responders
- Malware analysts
- Digital forensic examiners
- Researchers in operating system security
Capabilities and limits
Major capabilities
- Framework and plugin model for Windows and Linux memory images, with macOS support deprecated
- Automatic Windows symbol table download and dwarf2json for Linux and macOS kernels
- Process, thread, handle, module and network plugins
- Malware-oriented plugins for injected code, hooks and hidden processes
- Dumping of files, drivers, process memory and registry data from the image
- Timelining of memory artefacts alongside disk timelines
- Output renderers for text, CSV and JSON
- Layered address space handling for several memory image formats
Technical limitations
- No acquisition. A separate tool must capture the memory first
- The symbol table must match the kernel exactly. Unusual Linux builds need a table made by hand
- A memory image is a snapshot of a moving system and may contain inconsistent structures
- macOS analysis is marked deprecated in the current release notes
- Volatility 2 plugins do not run in Volatility 3
- Interpretation needs operating system internals knowledge that the tool does not supply
Learning with DFRTI
Independent professional education covering the principles and workflows of Volatility 3. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- Operating system internals, especially process and memory management
- Malware behaviour and persistence techniques
- Python basics for custom plugins and symbol table work
Disciplines
Related tools
- VelociraptorVelociraptor puts a small agent on endpoints and lets an examiner ask them questions in a query language. A hunt sends the same question to every machine and the answers come back as tables.Rapid7
- KAPE (Kroll Artifact Parser and Extractor)KAPE copies the files an examiner needs from a Windows system or image in minutes and then runs other programs over them. It is the quickest route from a live machine to parsed artefacts.Kroll
- Exterro FTK ImagerFTK Imager is the free tool most learners meet first. It makes forensic images of drives, folders and memory, verifies them with hashes and lets an examiner preview evidence before committing to a full acquisition.Exterro
- Magnet AxiomAxiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.Magnet Forensics
- Belkasoft X ForensicBelkasoft X is a single tool for computer, mobile, drone, vehicle and cloud evidence. Belkasoft sells X Forensic to government customers and X Corporate to businesses, both on a perpetual licence.Belkasoft
Courses that cover this tool
MalwareIncident Response & Malware AnalysisMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.
MalwareIncident Response & Malware AnalysisMalware Reverse EngineeringTake malware apart safely with static and dynamic analysis, Ghidra, x64dbg and YARA.
MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.