volatility3 / vol

Memory forensics framework (rewrite; Python 3).

$ vol -f mem.raw windows.info
$ vol -f mem.raw windows.pslist
$ vol -f mem.raw windows.malfind
$ vol -f mem.raw linux.bash