volatilityfoundation/volatilityAn advanced memory forensics framework
This project is archived. See Volatility 3 for modern investigations: https://github.com/volatilityfoundation/volatility3
The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.
The Volatility distribution is available from: http://www.volatilityfoundation.org/#!releases/component_71401
Volatility should run on any platform that supports Python (http://www.python.org)
Volatility supports investigations of the following memory images:
Windows:
Note: Please see the guidelines at the following link for notes on compatibility with recently patched Windows 7 (or later) memory samples:
https://github.com/volatilityfoundation/volatility/wiki/2.6-Win-Profiles
Linux:
Mac OSX:
Volatility does not provide memory sample acquisition capabilities. For acquisition, there are both free and commercial solutions available. If you would like suggestions about suitable acquisition solutions, please contact us at:
volatility (at) volatilityfoundation (dot) org
Volatility supports a variety of sample file formats and the ability to convert between these formats:
For a more detailed list of capabilities, see the following:
https://github.com/volatilityfoundation/volatility/wiki
Also see the community plugins repository:
https://github.com/volatilityfoundation/community
If you want to give Volatility a try, you can download exemplar memory images from the following url:
https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples
Mailing lists to support the users and developers of Volatility can be found at the following address:
http://lists.volatilesystems.com/mailman/listinfo
For information or requests, contact:
Volatility Foundation
Web: http://www.volatilityfoundation.org http://volatility-labs.blogspot.com http://volatility.tumblr.com
Email: volatility (at) volatilityfoundation (dot) org
IRC: #volatility on freenode
Twitter: @volatility
Some plugins may have other requirements which can be found at: https://github.com/volatilityfoundation/volatility/wiki/Installation
Unpack the latest version of Volatility from volatilityfoundation.org
To see available options, run "python vol.py -h" or "python vol.py --info"
Example:
$ python vol.py --info Volatility Foundation Volatility Framework 2.6
AMD64PagedMemory - Standard AMD 64-bit address space. ArmAddressSpace - Address space for ARM processors FileAddressSpace - This is a direct file AS. HPAKAddressSpace - This AS supports the HPAK format IA32PagedMemory - Standard IA-32 paging address space. IA32PagedMemoryPae - This class implements the IA-32 PAE paging address space. It is responsible LimeAddressSpace - Address space for Lime LinuxAMD64PagedMemory - Linux-specific AMD 64-bit address space. MachOAddressSpace - Address space for mach-o files to support atc-ny memory reader OSXPmemELF - This AS supports VirtualBox ELF64 coredump format QemuCoreDumpElf - This AS supports Qemu ELF32 and ELF64 coredump format VMWareAddressSpace - This AS supports VMware snapshot (VMSS) and saved state (VMSS) files VMWareMetaAddressSpace - This AS supports the VMEM format with VMSN/VMSS metadata VirtualBoxCoreDumpElf64 - This AS supports VirtualBox ELF64 coredump format Win10AMD64PagedMemory - Windows 10-specific AMD 64-bit address space. WindowsAMD64PagedMemory - Windows-specific AMD 64-bit address space. WindowsCrashDumpSpace32 - This AS supports windows Crash Dump format WindowsCrashDumpSpace64 - This AS supports windows Crash Dump format WindowsCrashDumpSpace64BitMap - This AS supports Windows BitMap Crash Dump format WindowsHiberFileSpace32 - This is a hibernate address space for windows hibernation files.