Volatility (software)

Volatility
Stable release
2.6.1 / December 19, 2018; 7 years ago (2018-12-19)
Written inPython
Operating systemWindows, Mac OS X, Linux
LicenseGNU GPL 2.0
Websitewww.volatilityfoundation.org
Repositoryhttps://github.com/volatilityfoundation/volatility

Volatility is an open-source memory forensics framework for incident response and malware analysis. It is written in Python and supports Microsoft Windows, Mac OS X, and Linux (as of version 2.5).

Volatility was created by Aaron Walters, drawing on academic research he did in memory forensics.

Operating system support

Volatility supports investigations of the following memory images:

Windows:

Mac OSX:

Linux:

Memory format support

Volatility supports a variety of sample file formats and the ability to convert between these formats:

References

  1. ↑ "The Volatility Foundation - Open Source Memory Forensics".
  2. ↑ Petroni, N. L., Walters, A., Fraser, T., & Arbaugh, W. A. (2006). FATKit: A framework for the extraction and analysis of digital forensic data from volatile system memory. Digital Investigation, 3(4), 197-210.
  3. ↑ Walters, A., & Petroni, N. L. (2007). Volatools: Integrating Volatile Memory into the Digital Investigation Process. Black Hat Briefings DC 2007, 1-18.
  4. ↑ "volatilityfoundation/volatility". GitHub. Retrieved 2020-12-25.