Volatility 3

Memory forensics — extract processes, network state, credentials, files, and malware artifacts from RAM images.

Installation

pip install volatility3
# or
git clone https://github.com/volatilityfoundation/volatility3 && cd volatility3 && pip install -e .

# Verify
python3 vol.py --help

# Alias (convenience)
alias vol='python3 /path/to/volatility3/vol.py'

Symbol Tables (Windows)