What it does
Volatility is a memory-forensics framework supported by the Volatility Foundation for investigating captured memory evidence.
Memory evidence can reveal a different part of an incident from files left on disk. Volatility provides a framework for analyzing that evidence, and the Foundation maintains the project and its community resources. Establish how the memory image was collected and which system it represents before choosing analysis steps. Keep acquisition details with the case because a memory result without that context is difficult to interpret. This is an investigator's analysis tool, not an antivirus replacement.
Strengths
- Dedicated memory-forensics workflow
Best for
- Incident responders analyzing acquired memory images