Volatility is the world's most widely used framework for extracting digital artifacts from volatile memory (RAM) samples
Volatility is built off of multiple plugins working together to obtain information from the memory dump.
Listed below are a few of the techniques and tools that can be used to extract a memory from a bare-metal machine.
Most of the tool above extract memory as .raw file extension.
For Virtual Machines, the output would depend on the hypervisor:
In Volatility, a plugin is a module that performs a specific type of analysis on a memory dump. Each plugin extracts and analyzes a different aspect of system memory, such as running processes, open network connections, loaded DLLs, and malware.
Here are some useful plugins and what they do: