Volatility 3

v2.7.0Volatility Foundation

The reference memory-analysis framework. Plugins enumerate processes, injected code, hidden modules, network endpoints and credentials from a memory image. The range's vol.py reads authored memory fixtures.

Category: Digital forensics & reverse engineering
Package: volatility3
Runs on: Linux · Windows
Commands: vol, vol.py, volatility, volatility3

Plugins read authored memory-image fixtures. No physical memory is ever accessed.

Install it

The scripts below install the real Volatility Foundation package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-volatility.sh

Windows installer (PowerShell)

Install-volatility.ps1

Volatility 3 has no unattended Windows install. Follow the steps on the package page.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Python (pip)

Install the interpreter tooling
```
sudo apt install -y python3-pip
```
Install Volatility 3
```
python3 -m pip install volatility3
```
Use a virtual environment on a shared host so the system Python stays clean.

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install Volatility 3
```
sudo apt install -y volatility3
```

Check it worked

Confirm it landed on PATH
```
which vol
```
Check the version
```
vol --version
```
The range reports 2.7.0.

Remove it

Take it off again
```
python3 -m pip uninstall volatility3
```

On Windows

Python (pip)

Install Python

winget install --id Python.Python.3.12 -e

Install Volatility 3
```
py -m pip install volatility3
```

Check it worked

Confirm it resolves
```
where vol
```
Check the version
```
vol --version
```
The range reports 2.7.0.

Remove it

Take it off again
```
winget uninstall --id volatility3
```

Inside the range

Tick it on the launch screen
Under Volatility 3's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y volatility3
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Volatility 3

Reps: Dead Box and Live RAMOne sample, one memory capture, one report. Hash and scan the dropper with real YARA, then run upstream Volatility 3 locally against a selected dump to find what pslist will not show you — and submit the findings.
Reps: Seeded Payload DropBreak into the Tomcat panel with Metasploit, drop the seeded payload, then take the artifact into Forge Triage. Grade on SHA-256, imphash and a YARA rule that fires on this sample.