> For the complete documentation index, see [llms.txt](https://dika-maulidal.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dika-maulidal.gitbook.io/home/digital-forensics/memory-forensics/volatility2.md).

# Volatility2

## Volatility 2 – Windows Memory Forensics Cheatsheet

Volatility 2 adalah framework klasik untuk analisis Windows memory dump berbasis profile.

Masih sangat relevan untuk:

* Kasus lama
* Windows XP / Windows 7
* Research & perbandingan metodologi
* Metadata & artefak klasik

### Metadata & Overview

| Detail         | Deskripsi                                        |
| -------------- | ------------------------------------------------ |
| Kategori       | Memory Forensics                                 |
| Supported OS   | Windows (XP – Windows 7 dominan)                 |
| Input Files    | `.raw`, `.mem`, `.dmp`, `.vmem`                  |
| Profile Model  | Manual (--profile)                               |
| Forensic Value | Hidden process, injection, hooks, kernel rootkit |