Volatility
Volatility
Volatility (Speicherforensik-Framework)
Volatility is an open-source framework for memory forensics — the analysis of a system's memory (RAM). From a memory image it reconstructs running processes, loaded modules, network connections and traces of malware. It is one of the most important tools for capturing fileless and disguised attacks.
History & facts. Volatility is maintained by the non-profit Volatility Foundation and has established itself as the standard of memory analysis. It interprets a previously taken memory image and reveals what happened in the system at runtime — including hidden processes, injected code and decrypted content that cannot be found on the data carrier. A modular plugin structure allows targeted investigations.
Outlook & recommendation. Since modern attacks increasingly operate in memory, memory forensics is often the only way to detect them — and Volatility the tool of choice. The prerequisite is a memory image taken during operation; if a suspicious system is prematurely shut down, this evidence is lost. Volatility therefore only realises its value in interplay with a clean, early acquisition within the scope of live forensics.