What do you need help with?

Volatility 3 Ultimate Memory Forensics Cheatsheet

Taylor Walton

23-Jan-2026

Volatility 3 Ultimate Memory Forensics Cheatsheet (Free PDF)

If you’re doing DFIR, malware analysis, or SOC triage, memory forensics is one of the fastest ways to confirm compromise. This cheatsheet gives you the practical Volatility 3 commands and workflows you’ll actually use—organized for quick investigations.

Download the Cheatsheet

Grab the PDF and keep it as your go-to reference for triage, malware hunting, and rootkit detection.

📄 Download: Volatility 3 Cheatsheet (PDF)

Watch the Full Tutorial

Want the full walkthrough (including how to spot hidden processes, injected code, suspicious DLLs, C2 connections, and rootkit hooks)? Watch the video here: https://youtu.be/R1X8V9yy_Y4

Volatility 3 Repo

Access the SOCFortress Volatility 3 repository (artifacts, install helpers, and related resources): https://github.com/socfortress/Volatility-3

What’s inside the cheatsheet

Quick Start / Triage: get system info fast (OS, kernel, symbols) and establish a baseline.
Process Analysis: pslist vs psscan, process trees, command lines, injection detection, VAD/memory mapping, privileges.
Network Analysis: identify suspicious sockets/connections and tie activity back to processes.
Registry Analysis: hives, persistence locations, UserAssist, ShimCache, execution artifacts.
Rootkit Detection: SSDT hooks, drivers/modules comparisons, callbacks, and kernel-level checks.
Malware Analysis: hollowing/unlinked modules/services/mutexes and artifact dumping.
IR Workflows: repeatable procedures for rootkits, malware, and ransomware investigations.
Pro Tips: CSV/JSON output, YARA scanning, discrepancy hunting, timeline building, and documentation hygiene.

How to use this during an investigation

Triage first: identify the OS/profile and establish your baseline process list.
Find what’s hiding: compare “list” vs “scan” style plugins to detect DKOM/rootkit techniques.
Confirm malicious behavior: look for injection indicators, suspicious DLL paths, abnormal privileges, and odd parent/child chains.
Pivot to network: tie external connections back to a process and validate the story.
Go kernel-deep if needed: SSDT, drivers, callbacks—especially if you suspect a rootkit.
Dump artifacts: export suspicious memory regions, drivers, or process data for offline analysis.