Volatility Framework: Memory forensics analysis toolkit
Open-source Python framework for extracting digital artifacts from RAM samples for Windows, Linux, and macOS forensics.
Learn more about Volatility Framework
Volatility Framework is a Python-based memory forensics toolkit that analyzes RAM dumps to extract digital artifacts and investigate system runtime state. The framework operates independently of the target system by parsing memory structures and reconstructing process information, network connections, and other volatile data. It supports multiple memory image formats including raw dumps, hibernation files, crash dumps, and virtual machine snapshots. The tool is commonly used for malware analysis, incident response, and digital forensics investigations.
Cross-Platform Support
Analyzes memory dumps from Windows, Linux, and macOS systems across multiple versions and architectures. Includes built-in profiles for different operating system versions and kernel builds.
Multiple File Formats
Processes various memory dump formats including raw linear samples, VMware snapshots, VirtualBox core dumps, and EWF format. Provides conversion capabilities between different sample formats.
Plugin Architecture
Extensible framework with modular plugins for different analysis tasks such as process listing, network connections, and registry examination. Supports community-developed plugins for specialized investigations.
# Basic usage to analyze a memory dump and list running processes
$ python vol.py -f memory_dump.raw --profile=Win7SP1x64 pslist
# Alternative with imageinfo to identify the correct profile first
$ python vol.py -f memory_dump.raw imageinfo
$ python vol.py -f memory_dump.raw --profile=Win7SP1x64 pslistVolatility 2.6: December 2016
- –Enhanced support for Windows 10 (including 14393.447)
- –Added new profiles for recently patched Windows 7, Windows 8, and Server 2012
- –Optimized page table enumeration and scanning algorithms, especially on 64-bit Windows 10
- –Added support for carving Internet Explorer 10 history records
- –Added support for memory dumps from the most recent VirtualBox version
See how people are using Volatility Framework
Related Repositories
Discover similar tools and frameworks used by developers
PentestGPT
AI-assisted Python framework for automated security testing.
subfinder
Passive subdomain discovery via DNS resolution and validation.
uBO Lite
Manifest V3 content blocker using declarative rules without persistent background processes.
cai
LLM-powered Python framework for automated penetration testing workflows.
CyberChef
Browser-based data transformation tool with chainable operations.