Volatility Foundation (https://www.volatilityfoundation.org/) offers pre-compiled binaries for Volatility 2.6 on Windows but the executable was last updated in 2016 and missing much of the newer Windows memory profiles. Google search revealed plenty of folks having trouble getting Volatility to work on Windows 10 from source and the closest I've found is Mike Cary's post on Installing Volatility on Windows. There's still a bunch of errors from his steps when I followed it, so here's a quick documentation of what I did to get Volatility 2.6.1 working.
Step 1: Download and install Python 2.7 from https://www.python.org/downloads/.
Step 2: Download and install Microsoft Visual C++ Compiler for Python 2.7 from https://www.microsoft.com/en-us/download/details.aspx?id=44266.
Step 3: Install Volatility 2.6.1 dependencies per https://github.com/volatilityfoundation/volatility/wiki/Installation:
- Distorm3: install version 3.3.4 as newer versions don't seem to support Python 2 nor work with Volatility 2.
pip install distorm3==3.3.4
- Yara: I tested version 3.8.1 which works. You can also try with other versions but note that there was an error about missing 'stdbool.h' for version 4.0.0.
pip install yara-python==3.8.1
- PyCrypto: no major issues encountered for current versions of pycrypto 2.6.1 and pycryptodome 3.9.7 with Python 2.
pip install pycrypto pycryptodome
- OpenPyxl: again, no issues with Python 2 support for current version 2.6.4.
pip install openpyxl
- ujson: it seems they have stopped supporting Python 2 for newer releases so I installed version 1.35.
pip install ujson==1.35
Step 4: Finally, download (or git clone) Volatility 2 from https://github.com/volatilityfoundation/volatility.
Now you should have a working version of Volatility 2 on Windows 10 with the latest profiles included. Refer to the Volatility Usage wiki for additional plugins. (E.g. memory baseline plugin by csababarta)
Last but not least, with end of support for Python 2, do consider switching to Volatility 3!
