> For the complete documentation index, see [llms.txt](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/misc/memory-forensics.md).

# Memory forensics

## Volatility

> An advanced memory forensics framework\
> [GitHub - volatilityfoundation/volatility](https://github.com/volatilityfoundation/volatility)

```bash
apt install volatility volatility-tools
```

```bash
volatility -f <memory-dump-file> imageinfo
volatility -f <memory-dump-file> --profile Win2020R2x64 clipboard
volatility -f <memory-dump-file> --profile Win2020R2x64 pstree
volatility -f <memory-dump-file> --profile Win2020R2x64 hashdump
```