thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Volatility

An open-source framework for extracting digital artifacts from memory images.

Definition

Volatility 3 plugins such as windows.pslist, windows.pstree, windows.psscan, windows.netscan, windows.malfind, windows.cmdline and windows.dlllist reveal processes, network connections, injected code and command lines. psscan can find hidden or terminated processes that pslist misses.

Example

vol -f mem.raw windows.malfind to locate injected executable memory regions.

Exam tip

malfind detects injected code; psscan finds hidden processes by scanning for structures.

Related terms