The Art of Memory Forensics

$ python vol.py pslist > pslist.txt
$ python vol.py pslist --output-file=pslist.txt

For example, if various plugins create _EPROCESS objects and they all commonly need to determine whether the process is suspicious, based on several factors, you can use an object class to add such logic. A simple example is shown in the following code:

third-party modules that Volatility can leverage and the specific plugins that utilize them