Volatility
Forensicskali · parrotAdvanced memory forensics framework for analyzing RAM dumps.
Install
sudo apt install volatility
Common commands
volatility -f memory.dmp imageinfo volatility -f memory.dmp --profile=Win10x64 pslist
Use only on systems you are authorized to test. Follow program scope.
Related tools
Autopsy
Digital forensics platform with GUI on top of The Sleuth Kit.
exiftool
Read and write meta information in files — useful for OSINT on documents and images.
foremost
File carving tool to recover files based on headers and footers.
Mat2
Metadata anonymisation toolkit — strip EXIF and document metadata before sharing.