DOT-Files/Gentoo/gentooamd/home/user/.tldrc/tldr/pages/windows/vol.py.md

# vol.py

> Forensics framework used to analyze volatile memory (RAM) dumps.
> With volatility3, plugins are now based on operating system. Examples below will use Windows.
> More information: <https://volatility3.readthedocs.io/en/latest/index.html>.

- Get information about a memory dump file:

`python3 vol.py {{[-f|--filename]}} {{path\to\memory_dump_file}} windows.info`

- List active processes:

`python3 vol.py {{[-f|--filename]}} {{path\to\memory_dump_file}} windows.pslist`

- List hashes of users on system:

`python3 vol.py {{[-f|--filename]}} {{path\to\memory_dump_file}} windows.hashdump`

- List active network connections:

`python3 vol.py {{[-f|--filename]}} {{path\to\memory_dump_file}} windows.netstat`

- Display help:

`python3 vol.py {{[-h|--help]}}`