Package: volatility3
Volatility 3: The volatile memory extraction frameworkVolatility is the world's most widely used framework for extracting digital
artifacts from volatile memory (RAM) samples. The extraction techniques are
performed completely independent of the system being investigated but offer
visibility into the runtime state of the system. The framework is intended
to introduce people to the techniques and complexities associated with
extracting digital artifacts from volatile memory samples and provide a
platform for further work into this exciting area of research.In 2019, the Volatility Foundation released a complete rewrite of the
framework, Volatility 3. The project was intended to address many of the
technical and performance challenges associated with the original
code base that became apparent over the previous 10 years. Another benefit
of the rewrite is that Volatility 3 could be released under a custom
license that was more aligned with the goals of the Volatility community,
the Volatility Software License (VSL). See theLICENSEfile for
more details.RequirementsVolatility 3 requires Python 3.7.0 or later. To install the most minimal set of dependencies (some plugins will not work) use a command such as:pip3install-rrequirements-minimal.txtAlternately, the minimal packages will be installed automatically when Volatility 3 is installed using setup.py. However, as noted in the Quick Start section below, Volatility 3 does notneedto be installed via setup.py prior to using it.python3setup.pybuildpython3setup.pyinstallTo enable the full range of Volatility 3 functionality, use a command like the one below. For partial functionality, comment out any unnecessary packages inrequirements.txtprior to running the command.pip3install-rrequirements.txtDownloading VolatilityThe latest stable version of Volatility will always be the stable branch of the GitHub repository. You can get the latest version of the code using the following command:gitclonehttps://github.com/volatilityfoundation/volatility3.gitQuick StartClone the latest version of Volatility from GitHub:gitclonehttps://github.com/volatilityfoundation/volatility3.gitSee available options:python3vol.py-hTo get more information on a Windows memory sample and to make sure
Volatility supports that sample type, runpython3 vol.py -f <imagepath> windows.infoExample:python3vol.py-f/home/user/samples/stuxnet.vmemwindows.infoRun some other plugins. The-for--single-locationis not strictly
required, but most plugins expect a single sample. Some also
require/accept other options.  Runpython3 vol.py <plugin> -hfor more information on a particular command.Symbol TablesSymbol table packs for the various operating systems are available for download at:https://downloads.volatilityfoundation.org/volatility3/symbols/windows.ziphttps://downloads.volatilityfoundation.org/volatility3/symbols/mac.ziphttps://downloads.volatilityfoundation.org/volatility3/symbols/linux.zipThe hashes to verify whether any of the symbol pack files have downloaded successfully or have changed can be found at:https://downloads.volatilityfoundation.org/volatility3/symbols/SHA256SUMShttps://downloads.volatilityfoundation.org/volatility3/symbols/SHA1SUMShttps://downloads.volatilityfoundation.org/volatility3/symbols/MD5SUMSSymbol tables zip files must be placed, as named, into thevolatility3/symbolsdirectory (or just the symbols directory next to the executable file).Windows symbols that cannot be found will be queried, downloaded, generated and cached.  Mac and Linux symbol tables must be manually produced by a tool such asdwarf2json.Important: The first run of volatility with new symbol files will require the cache to be updated.  The symbol packs contain a large number of symbol files and so may take some time to update!
However, this process only needs to be run once on each new symbol file, so assuming the pack stays in the same location will not need to be done again.  Please also note it can be interrupted and next run will restart itself.Please note: These are representative and are complete up to the point of creation for Windows and Mac.  Due to the ease of compiling Linux kernels and the inability to uniquely distinguish them, an exhaustive set of Linux symbol tables cannot easily be supplied.DocumentationThe framework is documented through doc strings and can be built using sphinx.The latest generated copy of the documentation can be found at:https://volatility3.readthedocs.io/en/latest/Licensing and CopyrightCopyright (C) 2007-2024 Volatility FoundationAll Rights Reservedhttps://www.volatilityfoundation.org/license/vsl-v1.0Bugs and SupportIf you think you've found a bug, please report it at:https://github.com/volatilityfoundation/volatility3/issuesIn order to help us solve your issues as quickly as possible,
please include the following information when filing a bug:The version of Volatility you're usingThe operating system used to run VolatilityThe version of Python used to run VolatilityThe suspected operating system of the memory sampleThe complete command line you used to run VolatilityFor community support, please join us on Slack:https://www.volatilityfoundation.org/slackContactFor information or requests, contact:Volatility FoundationWeb:https://www.volatilityfoundation.orgBlog:https://volatility-labs.blogspot.comEmail: volatility (at) volatilityfoundation (dot) orgTwitter:@volatility