# Introduction to Volatility

Volatility is the world's most widely used, open-source memory forensics framework. Written in Python, it allows investigators to analyze RAM captures (.raw, .vmem, .dmp) offline to reconstruct the exact state of a computer at the moment the memory was captured.

## Volatility 2 vs Volatility 3
There are two main versions of Volatility currently in use:
*   **Volatility 2:** The traditional version (Python 2). It requires the analyst to manually specify a **"Profile"** (the exact OS version, e.g., `Win7SP1x64`) before it can parse the memory image. If you guess the wrong profile, Volatility returns gibberish.
*   **Volatility 3:** The modern version (Python 3). It largely eliminates the need for manual profiles. Instead, it downloads "Symbol Tables" from Microsoft on the fly to automatically figure out the OS version and parse the structures.

Everything in this module focuses on Volatility 3, as it is the current industry standard.

## Basic Syntax (Volatility 3)
The syntax for Volatility 3 is straight-forward: you run the `vol.py` script, provide the target memory image using `-f`, and then specify a **plugin**.

A plugin is a specific script that looks for a specific artifact in memory.

**Syntax:** 
`python3 vol.py -f <memory_image> <plugin_name>`

**Example:**
`python3 vol.py -f infected_laptop.raw windows.info`

## The 'windows.info' Plugin
The absolute first plugin you should run on any new memory image is `windows.info`.

*   **What it does:** It analyzes the basic header structures of the memory image to determine the exact Operating System version, the primary architecture (32-bit vs 64-bit), the exact build number, and the time the memory image was created.
*   **Forensic Value:** It proves the memory image is sound and readable, and gives you the exact timestamp of the acquisition, which is perfectly aligned toUTC time (unlike disk timestamps which might be affected by local timezones).