Science Score: 54.0%
This score indicates how likely this project is to be science-related based on various indicators:
-
✓CITATION.cff file
Found CITATION.cff file -
✓codemeta.json file
Found codemeta.json file -
✓.zenodo.json file
Found .zenodo.json file -
○DOI references
-
○Academic publication links
-
✓Committers with academic emails
8 of 91 committers (8.8%) from academic institutions -
○Institutional organization owner
-
○JOSS paper metadata
-
○Scientific vocabulary similarity
Low similarity (14.6%) to scientific vocabulary
Keywords
Repository
Volatility 3.0 development
Basic Info
- Host: GitHub
- Owner: volatilityfoundation
- License: other
- Language: Python
- Default Branch: develop
- Homepage: http://volatilityfoundation.org/
- Size: 8.89 MB
Statistics
- Stars: 3,411
- Watchers: 63
- Forks: 561
- Open Issues: 124
- Releases: 13
Topics
Metadata Files
README.md
Volatility 3: The volatile memory extraction framework
Volatility is the world's most widely used framework for extracting digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.
In 2019, the Volatility Foundation released a complete rewrite of the framework, Volatility 3. The project was intended to address many of the technical and performance challenges associated with the original code base that became apparent over the previous 10 years. Another benefit of the rewrite is that Volatility 3 could be released under a custom license that was more aligned with the goals of the Volatility community, the Volatility Software License (VSL). See the LICENSE file for more details.
Quick Start
Install the required dependencies:
shell pip install --user -e ".[full]"See available options:
shell vol -hTo get more information on a Windows memory sample and to make sure Volatility supports that sample type, run
vol -f <imagepath> windows.info:shell vol -f /home/user/samples/stuxnet.vmem windows.infoRun some other plugins. The
-for--single-locationis not strictly required, but most plugins expect a single sample. Some also require/accept other options. Runvol <plugin> -hfor more information on a particular command.
Installing
Volatility 3 requires Python 3.8.0 or later and is published on the PyPi registry.
shell
pip install volatility3
If you want to use the latest development version of Volatility 3 we recommend you manually clone this repository and install an editable version of the project. We recommend you use a virtual environment to keep installed dependencies separate from system packages.
The latest stable version of Volatility will always be the stable branch of the GitHub repository. The default branch is develop.
shell
git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3/
python3 -m venv venv && . venv/bin/activate
pip install -e ".[dev]"
Symbol Tables
Symbol table packs for the various operating systems are available for download at:
https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip
The hashes to verify whether any of the symbol pack files have downloaded successfully or have changed can be found at:
https://downloads.volatilityfoundation.org/volatility3/symbols/SHA256SUMS https://downloads.volatilityfoundation.org/volatility3/symbols/SHA1SUMS https://downloads.volatilityfoundation.org/volatility3/symbols/MD5SUMS
Symbol tables zip files must be placed, as named, into the volatility3/symbols directory (or just the symbols directory next to the executable file).
Windows symbols that cannot be found will be queried, downloaded, generated and cached. Mac and Linux symbol tables must be manually produced by a tool such as dwarf2json.
Important: The first run of volatility with new symbol files will require the cache to be updated. The symbol packs contain a large number of symbol files and so may take some time to update! However, this process only needs to be run once on each new symbol file, so assuming the pack stays in the same location will not need to be done again. Please also note it can be interrupted and next run will restart itself.
Please note: These are representative and are complete up to the point of creation for Windows and Mac. Due to the ease of compiling Linux kernels and the inability to uniquely distinguish them, an exhaustive set of Linux symbol tables cannot easily be supplied.
Documentation
The framework is documented through doc strings and can be built using sphinx.
The latest generated copy of the documentation can be found at: https://volatility3.readthedocs.io/en/latest/
Licensing and Copyright
Copyright (C) 2007-2025 Volatility Foundation
All Rights Reserved
https://www.volatilityfoundation.org/license/vsl-v1.0
Bugs and Support
If you think you've found a bug, please report it at:
https://github.com/volatilityfoundation/volatility3/issues
In order to help us solve your issues as quickly as possible, please include the following information when filing a bug:
- The version of Volatility you're using
- The operating system used to run Volatility
- The version of Python used to run Volatility
- The suspected operating system of the memory sample
- The complete command line you used to run Volatility
For community support, please join us on Slack:
https://www.volatilityfoundation.org/slack
Contact
For information or requests, contact:
Volatility Foundation
Web: https://www.volatilityfoundation.org
Blog: https://volatility-labs.blogspot.com
Email: volatility (at) volatilityfoundation (dot) org
Twitter: @volatility
Owner
- Name: Volatility Foundation
- Login: volatilityfoundation
- Kind: organization
- Website: volatilityfoundation.org
- Repositories: 7
- Profile: https://github.com/volatilityfoundation
Citation (CITATION.cff)
# This CITATION.cff file was generated with cffinit.
# Visit https://bit.ly/cffinit to generate yours today!
cff-version: 1.2.0
title: Volatility 3
message: >-
If you reference this software, please feel free to cite
it using the information below.
type: software
authors:
- name: Volatility Foundation
country: US
website: 'https://www.volatilityfoundation.org/'
identifiers:
- type: url
value: 'https://github.com/volatilityfoundation/volatility3'
description: Volatility 3 source code repository
repository-code: 'https://github.com/volatilityfoundation/volatility3'
url: 'https://github.com/volatilityfoundation/volatility3'
abstract: >-
Volatility is the world's most widely used framework for
extracting digital artifacts from volatile memory (RAM)
samples. The extraction techniques are performed
completely independent of the system being investigated
but offer visibility into the runtime state of the system.
The framework is intended to introduce people to the
techniques and complexities associated with extracting
digital artifacts from volatile memory samples and provide
a platform for further work into this exciting area of
research.
keywords:
- malware
- forensics
- memory
- python
- ram
- volatility
Committers
Last synced: 9 months ago
Top Committers
| Name | Commits | |
|---|---|---|
| Mike Auty | m****y@g****m | 2,765 |
| Gustavo Moreira | g****a@g****m | 432 |
| Andrew Case | a****w@d****g | 354 |
| Abyss Watcher | a****r@p****e | 227 |
| David McDonald | d****a@u****u | 216 |
| Donghyun Kim | d****9@g****m | 161 |
| Eve | e****e@t****o | 119 |
| Michael Ligh | m****h@v****m | 102 |
| Dave Lassalle | d****e@v****m | 88 |
| j-t-1 | 1****1 | 81 |
| superponible | d****e@s****m | 48 |
| Paul Kermann | p****n@t****m | 44 |
| atcuno | a****o@g****m | 42 |
| Tejas | 4****2 | 32 |
| Matt Tressler | m****0@g****m | 31 |
| Jan | j****7@g****t | 30 |
| k1nd0ne | k****e@m****m | 27 |
| Analyst | a****t@A****n | 25 |
| Arthur Deierlein | i****o@c****v | 25 |
| RuBublik | r****r@g****m | 21 |
| memoryforensics1 | 6****1 | 18 |
| Nick L. Petroni, Jr | n****i@v****m | 18 |
| hsarkey | h****y@v****m | 16 |
| KevTheHermit | k****t@g****m | 16 |
| Elad Levi | 9****i@g****m | 16 |
| AsafEitani | a****e@s****o | 15 |
| cpuu | c****u@i****m | 15 |
| Mike Auty | m****e@i****g | 14 |
| xabiugarte | x****e | 12 |
| Jack Wenger | j****r@g****m | 11 |
| and 61 more... | ||
Committer Domains (Top 20 + Academic)
Issues and Pull Requests
Last synced: 6 months ago
All Time
- Total issues: 446
- Total pull requests: 1,134
- Average time to close issues: 8 months
- Average time to close pull requests: about 1 month
- Total issue authors: 240
- Total pull request authors: 67
- Average comments per issue: 4.01
- Average comments per pull request: 2.01
- Merged pull requests: 854
- Bot issues: 0
- Bot pull requests: 0
Past Year
- Issues: 194
- Pull requests: 793
- Average time to close issues: 19 days
- Average time to close pull requests: 6 days
- Issue authors: 63
- Pull request authors: 31
- Average comments per issue: 1.48
- Average comments per pull request: 1.62
- Merged pull requests: 617
- Bot issues: 0
- Bot pull requests: 0
Top Authors
Issue Authors
- atcuno (88)
- ikelos (22)
- eve-mem (12)
- superponible (8)
- gcmoreira (8)
- Abyss-W4tcher (7)
- j-t-1 (5)
- SolitudePy (5)
- dgmcdona (5)
- yassine955 (4)
- vobst (4)
- garanews (4)
- the-rectifier (4)
- lic-8 (3)
- cmuws8n (3)
Pull Request Authors
- atcuno (209)
- ikelos (193)
- gcmoreira (132)
- dgmcdona (116)
- j-t-1 (81)
- Abyss-W4tcher (80)
- eve-mem (74)
- SolitudePy (51)
- superponible (30)
- paulkermann (14)
- joren485 (8)
- the-rectifier (8)
- forensicxlab (7)
- TheMythologist (7)
- c0rydoras (6)
Top Labels
Issue Labels
Pull Request Labels
Packages
- Total packages: 6
-
Total downloads:
- pypi 37,587 last-month
- homebrew 219 last-month
- Total docker downloads: 764,732
-
Total dependent packages: 0
(may contain duplicates) -
Total dependent repositories: 11
(may contain duplicates) - Total versions: 58
- Total maintainers: 4
pypi.org: volatility3
Memory forensics framework
- Documentation: https://volatility3.readthedocs.io/
- License: VSL
-
Latest release: 2.26.0
published 9 months ago
Rankings
proxy.golang.org: github.com/volatilityfoundation/volatility3
- Documentation: https://pkg.go.dev/github.com/volatilityfoundation/volatility3#section-documentation
- License: other
-
Latest release: v2.26.0+incompatible
published 10 months ago
Rankings
alpine-edge: volatility3-pyc
Precompiled Python bytecode for volatility3
- Homepage: https://github.com/volatilityfoundation/volatility3
- License: custom
-
Latest release: 2.26.0-r0
published 6 months ago
Rankings
Maintainers (1)
alpine-edge: volatility3
Volatile memory forensics toolkit
- Homepage: https://github.com/volatilityfoundation/volatility3
- License: custom
-
Latest release: 2.26.0-r0
published 6 months ago
Rankings
Maintainers (1)
alpine-edge: volatility3-doc
Volatile memory forensics toolkit (documentation)
- Homepage: https://github.com/volatilityfoundation/volatility3
- License: custom
- Status: removed
-
Latest release: 2.11.0-r0
published about 1 year ago
Rankings
Maintainers (1)
formulae.brew.sh: volatility
Advanced memory forensics framework
- Homepage: https://github.com/volatilityfoundation/volatility3
- License: Cannot Represent
- Status: removed
-
Latest release: 2.5.2
published about 2 years ago
Rankings
Dependencies
- actions/checkout v2 composite
- psf/black stable composite
- actions/checkout v3 composite
- actions/setup-python v4 composite
- actions/upload-artifact v2 composite
- actions/checkout v3 composite
- github/codeql-action/analyze v2 composite
- github/codeql-action/autobuild v2 composite
- github/codeql-action/init v2 composite
- actions/checkout v3 composite
- actions/setup-python v4 composite
- sphinx >=4.0.0
- sphinx-rtd-theme >=0.4.3
- sphinx_autodoc_typehints >=1.4.0
- capstone >=3.0.5 development
- jsonschema >=2.3.0 development
- leechcorepyc >=2.4.0 development
- pefile >=2017.8.1 development
- pycryptodome * development
- python-snappy ==0.6.0 development
- yara-python >=3.8.0 development
- pefile >=2017.8.1
- capstone >=3.0.5
- leechcorepyc >=2.4.0
- pefile >=2017.8.1
- pycryptodome *
- python-snappy ==0.6.0
- yara-python >=3.8.0
- pefile >=2017.8.1 test
- pytest >=7.0.0 test
- yara-python >=3.8.0 test
- actions/checkout v3 composite
- actions/setup-python v4 composite
- actions/stale v5 composite