Glossary term
Volatility
Volatility is an open-source memory forensics framework used to analyse RAM images from Windows, macOS, and Linux systems for running processes, network connections, decrypted content, and malware artifacts.
Volatility has been the standard tool for memory forensics since its release in the late 2000s. The framework supports a wide range of plugins for extracting specific artifact types from a memory image.
Common Volatility outputs include the list of running processes (with parent-process relationships), open network connections (with remote IPs and ports), loaded DLLs, registry hives in memory, browser session data, encryption keys for mounted volumes, and indicators of code injection or process hollowing.
For incident response, Volatility is the primary tool when the matter requires evidence of what was running at the moment of compromise. Memory cannot be reconstructed after the fact, so it must be acquired before the system is shut down.