Volatility 3

Open-source memory forensics framework, Python 3 rewrite of Volatility 2. Symbol-based (PDB symbols on Windows) instead of profile-based, supports modern Windows 10/11 and Linux kernels, plugin ecosystem includes pslist, pstree, psxview, malfind, hollowfind, netscan, dlllist.