RAM remembers: passwords, injected code, connections — even when the disk is wiped. Volatility reads memory captures like an X-ray of a running machine.
Follow the steps — click any step card to replay the terminal demo from that point. Everything runs in a lab you control.
Framework identifies the right symbol tables.
pslist = task manager of the past.
psscan finds processes unlinked from lists — rootkit tell.
Dead machine's last connections, recovered.
Carve the malicious binary out of RAM for full reversing.
| -f file | memory image |
| windows.pslist | process list |
| windows.psscan | hidden processes |
| windows.netstat | connections |
| windows.malfind | injected code |
| --dump | extract targets |
malfind + psscan is the 80/20 malware-triage combo — learn it cold.
13Cubed's YouTube channel is the unofficial Volatility university.
Memory CTFs on CyberDefenders teach plugins one at a time.
Capture RAM with tools like Magnet/FTK on live IR; analysis comes after.
Use Volatility 3 only on systems you own or have written permission to test. Your lab: Kali + Metasploitable2, DVWA, TryHackMe & HackTheBox — plenty of legal targets, zero risk.