mem_vol2
Run read-only Volatility 2 plugins on memory images that Volatility 3 cannot load. Extract structured data such as processes, network connections, and handles with auto profile detection.
Instructions
Run a Volatility 2 plugin for full structured memory forensics on images Volatility 3 cannot load. Common plugins: pslist, pstree, psscan, netscan, connscan, sockets, malfind, cmdline, consoles, cmdscan, dlllist, getsids, handles. If profile is empty it is auto-detected (and cached). Returns structured rows with PIDs, addresses, etc. Dump/output plugins and flags are refused (no write primitive); use read-only plugins.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| image | Yes | ||
| plugin | Yes | ||
| profile | No | ||
| extra_args | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |