Setup

Installation Linux

Installation Windows

The basics

List available plugins

vol --help

Search plugins:

vol --help | grep -i linux

vol --help | grep -i windows

Windows

<aside> ⚠️

Some lines may be too long to display properly. To improve readability, increase the screen buffer width in PowerShell or Command Prompt (CMD).

Right-click the title bar > Properties > Layout > Screen Buffer Size > Width.

</aside>

Identify the memory image

vol -f memory.raw windows.info

Processes

List processes

vol -f memory.raw windows.pslist

Process tree

vol -f memory.raw windows.pstree

The tree is often more useful than pslist because it shows parent/child relationships.