Volatility is the de facto memory forensics framework. Versions 2 (Python 2) and 3 (Python 3) are both still seen in the field. It parses raw memory captures (.mem, .raw, .vmem, .dmp) for Windows, Linux, and macOS.

Plugins every CySA+ candidate should know:

• pslist, pstree, psscan — process listing (cross-validating user-mode list with kernel-pool scan).
• netscan / netstat — open sockets and listeners.
• cmdline, consoles, cmdscan — recovered command-line history.
• malfind — hidden injected code.
• dumpfiles, procdump — extract artefacts for further analysis.
• hivelist, printkey, hashdump — registry forensics from RAM.

• Identifying injected code post-incident
• Recovering cleartext credentials from RAM
• Listing rootkit-hidden processes
• Extracting attacker tools that lived only in memory