The Volatility Framework is a completely open collection of tools, implemented in Python, for the extraction of digital artifacts from volatile memory (RAM) samples.
The extraction techniques are performed completely independent of the system being investigated but offer visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.
Volatility was designed by forensics, incident response, and malware experts to focus on the types of tasks these analysts typically form.
Key Features
- Single, cohesive framework analyzes RAM dumps from 32- and 64-bit windows, linux, mac, and android systems. Volatility’s modular design allows it to easily support new operating systems and architectures as they are released.
- Carving.
- Command histories.
- Console input/output buffers.
- USER objects (GUI memory).
- Network related data structures.
- Extensible and scriptable API.
- Fast and efficient algorithms let you analyze RAM dumps from large systems without unnecessary overhead or memory consumption.
- Supports a variety of sample file formats and the ability to convert between these formats:
- Raw linear sample (dd).
- Hibernation file (from Windows 7 and earlier).
- Crash dump file.
- VirtualBox ELF64 core dump.
- VMware saved state and snapshot files.
- EWF format (E01).
- LiME format.
- Mach-O file format.
- QEMU virtual machine dumps.
- Firewire HPAK (FDPro).
- Cross-platform support – runs under Linux, Mac OS X, and Windows.
Website: www.volatilityfoundation.org
Support: Documentation Project, GitHub Code Repository
Developer: Volatility Foundation
License: GNU General Public License v2.0
Volatility is written in Python. Learn Python with our recommended free books and free tutorials.
Related Software
| Digital Forensics Tools | |
|---|---|
| GRR Rapid Response | Remote live forensics for incident response |
| Radare2 | Portable reversing framework |
| The Sleuth Kit | Collection of tools for forensic analysis |
| Autopsy Forensic Browser | Graphical interface to SleuthKit |
| iaito | Official graphical interface for radare2 |
| Volatility | Advanced memory forensics framework |
| guymager | Forensic imaging tool based on Qt |
| dcfldd | Enhanced version of dd for forensics and security |
| rdd | Forensic copy program |
| Jomon | Network forensics and passive sniffer |
| Mozilla InvestiGator | Real-time digital forensics and investigation platform |
| Velociraptor | Endpoint visibility and collection tool |
| Timesketch | Collaborative forensic timeline analysis |
| Plaso | Python-based digital forensics framework |
| MemProcFS | View physical memory as files in a virtual file system |
| Chainsaw | Fast forensic triage and threat hunting tool for Windows artefacts |
Read our verdict in the software roundup.
| Forensics Memory Tools | |
|---|---|
| MemProcFS | View physical memory as files in a virtual file system |
| pypykatz | Python implementation of Mimikatz |
| Volatility | Advanced memory forensics framework |
| AVML | Acquire Volatile Memory for Linux |
| Volshell | CLI tool for working with memory |
| EVTXtract | Recovers and reconstructs fragments of EVTX log files |
| yarp | Yet Another Registry Parser |
| AutoTimeliner | Extract forensic timeline from volatile memory dump |
Read our verdict in the software roundup.
 Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category.This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form. |