Home / ARP / ELF / Forensics / Forensics Framework / Linux / Mac / Memory Forensics / Processes / Rootkit / Scan / Scanner / Volatility / Volatility Framework / Windows / Yara / Volatility 2.6 - Advanced Memory Forensics Framework

Volatility 2.6 - Advanced Memory Forensics Framework

| Post sponsored by FaradaySEC | Multiuser Pentest Environment

In 2007, the first version of The Volatility Framework was released publicly at Black Hat DC. The software was based on years of published academic research into advanced memory analysis and forensics. Up until that point, digital investigations had focused primarily on finding contraband within hard drive images. Volatility introduced people to the power of analyzing the runtime state of a system using the data found in volatile storage (RAM). It also provided a cross-platform, modular, and extensible platform to encourage further work into this exciting area of research. Another major goal of the project was to encourage the collaboration, innovation, and accessibility to the knowledge that had been common within the offensive software communities.

Since that time, memory analysis has become one of the most important topics to the future of digital investigations and Volatility has become the world’s most widely used memory forensics platform. The project is supported by one of the largest and most active communities in the forensics industry. Volatility also provides a unique platform that enables cutting-edge research to be immediately transitioned into the hands of digital investigators. As a result, research built on top of Volatility has appeared at the top academic conferences and Volatility has been used on some of the most critical investigations of the past decade. It has become an indispensable digital investigation tool relied upon by law enforcement, military, academia, and commercial investigators throughout the world.

Volatility development is now supported by The Volatility Foundation, an independent 501(c) (3) non-profit organization. The foundation was established to promote the use of Volatility and memory analysis within the forensics community, to defend the project's intellectual property (trademarks, licenses, etc.) and longevity, and, finally, to help advance innovative memory analysis research. Along these lines, the foundation was also formed to help protect the rights of the developers who sacrifice their time and resources to make the world’s most advanced memory forensics platform free and open source.


Quick Start
  • Choose a release - the most recent is [Volatility 2.6] (http://www.volatilityfoundation.org/26), released December 2016. Older versions are also available on the Releases page or respective release pages. If you want the cutting edge development build, use a git client and clone the master.
  • Install the code - Volatility is packaged in several formats, including source code in zip or tar archive (all platforms), a Pyinstaller executable (Windows only) and a standalone executable (Windows only). For help deciding which format is best for your needs, and for installation or upgrade instructions, see Installation.
  • Target OS specific setup - the Linux, Mac, and Android support may require accessing symbols and building your own profiles before using Volatility. If you plan to analyze these operating systems, please see Linux, Mac, or Android.
  • Read usage and plugins - command-line parameters, options, and plugins may differ between releases. For the most recent information, see Volatility Usage, Command Reference and our Volatility Cheat Sheet.

Why Volatility
  • A single, cohesive framework analyzes RAM dumps from 32- and 64-bit Windows, Linux, mac, and android systems. Volatility's modular design allows it to easily support new operating systems and architectures as they are released. All your devices are targets...so don't limit your forensic capabilities to just Windows computers.
  • It's Open Source GPLv2, which means you can read it, learn from it, and extend it. Why use a tool that outputs results without giving you any indication where the values came from or how they were interpreted? Learn how your tools work, understand why and how to tweak and enhance them - help yourself become a smarter analyst. You can also immediately fix any issues you discover, instead of having to wait weeks or months for vendors to communicate, reproduce, and publish patches.
  • It's written in Python, an established forensic and reverse engineering language with loads of libraries that can easily integrate into volatility. Most analysts are already familiar with Python and don't want to learn new languages. For example, windbg's scripting syntax which is often seen as cryptic and many times the capabilities just aren't there. Other memory analysis frameworks require you to use Visual Studio to compile C# DLLs and the rest don't expose a programming API at all.
  • Runs on Windows, Linux, or Mac analysis systems (anywhere Python runs) - a refreshing break from other memory analysis tools that only run on windows and require .NET installations and admin privileges just to open. If you're already accustomed to performing forensics on a particular host OS, by all means, keep using it - and take volatility with you.
  • Extensible and scriptable API gives you the power to go beyond and continue innovating. For example, you can use volatility to build a customized web interface or GUI, drive your malware sandbox, perform virtual machine introspection or just explore kernel memory in an automated fashion. Analysts can add new address spaces, plugins, data structures, and overlays to truly weld the framework to their needs. You can explore the Doxygen documentation for Volatility to get an idea of its internals.
  • Unparalleled feature sets based on reverse engineering and specialized research. Volatility provides capabilities that Microsoft's own kernel debugger doesn't allow, such as carving command histories, console input/output buffers, USER objects (GUI memory), and network-related data structures. Just because it's not documented doesn't mean you can't analyze it!
  • Comprehensive coverage of file formats - volatility can analyze raw dumps, crash dumps, hibernation files, VMware .vmem, VMware saved state and suspended files (.vmss/.vmsn), VirtualBox core dumps, LiME (Linux Memory Extractor), expert witness (EWF), and direct physical memory over Firewire. You can even convert back and forth between these formats. In the heat of your incident response moment, don't get caught looking like a fool when someone hands you a format your other tools can't parse.
  • Fast and efficient algorithms let you analyze RAM dumps from large systems without unnecessary overhead or memory consumption. For example, volatility is able to list kernel modules from an 80 GB system in just a few seconds. There is always room for improvement, and timing differs per command, however other memory analysis frameworks can take several hours to do the same thing on much smaller memory dumps.
  • A serious and powerful community of practitioners and researchers who work in the forensics, IR, and malware analysis fields. It brings together contributors from commercial companies, law enforcement, and academic institutions around the world. Don't just take our word for it - check out the Volatility Documentation Project - a collection of over 200 docs from 60+ different authors. Volatility is also being built on by a number of large organizations such as Google, National DoD Laboratories, DC3, and many Antivirus and security shops.
  • Forensics/IR/malware focus - Volatility was designed by forensics, incident response, and malware experts to focus on the types of tasks these analysts typically form. As a result, there are things that are often very important to a forensics analysts that are not as important to a person debugging a kernel driver (unallocated storage, indirect artifacts, etc).

Volatility 2.6 - Advanced Memory Forensics Framework Volatility 2.6 - Advanced Memory Forensics Framework Reviewed by Zion3R on 11:09 AM Rating: 5