Volatility is the de-facto standard for memory forensics. It reads a RAM dump and rebuilds the kernel's data structures in userland, letting you list processes, connections, modules, and file handles — even from memory that no longer maps to a running system. There are two active branches: Volatility 3 (current, Python 3, auto-detect) and Volatility 2 (classic, per-kernel profiles, still preferred by many Linux workflows).
pip install volatility3
# use the console script (vol3) or the python module
vol3 --help
# also grab the standalone tools for memory acquisition
# LiME (capture) -> https://github.com/504ensicsLabs/limegit clone https://github.com/volatilityfoundation/volatility.git
cd volatility
python setup.py install
# Linux profiles must be built on the target kernel:
# 1. cd volatility/tools/linux; make
# 2. zip module.dwarf + System.map into .zip
# 3. drop it into volatility/volatility/plugins/overlays/linux/# volatility 3 - file info & auto profile
vol3 -f /evidence/ram.lime linux.info
# what plugins are available
vol3 -f /evidence/ram.lime linux.pslist --help
# volatility 2 - verify the profile is right
python vol.py -f /evidence/ram.lime --profile=LinuxUbuntu20_04x64 linux_pslist --info| Plugin | Use |
|---|---|
| linux.pslist / linux.pstree | Process list; parent/child tree |
| linux.psaux | Processes with full command lines |
| linux.proc.maps | Memory maps per process |
| linux.bash | Recovered bash history from memory |
| linux.netstat | Network connections at capture time |
| linux.sockets | Socket objects, even closed ones |
| linux.lsmod | Loaded kernel modules |
| linux.malfind | Injected/executable memory without a backing file |
| linux.check_syscall | Syscall table hook detection (rootkit) |
| linux.check_tty | TTY hook detection (keyloggers) |
| linux.dmesg | Kernel ring buffer |
| linux.proc -p PID --dump | Dump a process image for offline analysis |
Volatility 3 reads raw, EWF, and LiME formats. Volatility 2 additionally handles older formats with the right profile. LiME dumps carry their own header so profiling is straightforward.
file /evidence/ram.lime
ram.lime: Linux Memory Dump (LiME format)
vol3 -f /evidence/ram.lime linux.infouname -r and uname -a while the machine is up.
vol3 -f ram.lime linux.psaux
vol3 -f ram.lime linux.pstree
vol3 -f ram.lime linux.netstat
vol3 -f ram.lime linux.lsmod
vol3 -f ram.lime linux.check_syscall
vol3 -f ram.lime linux.malfind
vol3 -f ram.lime linux.bash
vol3 -f ram.lime linux.proc -p 31337 --dumpPair findings with the memory forensics article for interpretation, and with logs for correlation.