{"repo":"volatilityfoundation/volatility3","free":true,"listed":false,"github":"https://github.com/volatilityfoundation/volatility3","clone":"git clone https://github.com/volatilityfoundation/volatility3.git","description":"Volatility 3.0 development","language":"Python","stars":4334,"topics":["digital-investigation","forensics","incident-response","malware","memory","python","ram","volatility","volatility-framework"],"license":null,"category":"dev-tools","readme_excerpt":"Volatility 3: The volatile memory extraction framework Volatility is the world's most widely used framework for extracting digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research. In 2019, the Volatility Foundation released a complete rewrite of the framework, Volatility 3. The project was intended to address many of the technical and performance challenges associated with the original code base that became apparent over the previous 10 years. Another benefit of the rewrite is that Volatility 3 could be released under a custom license that was more aligned with the goals of the Volatility community, the Volatility Software License (VSL). See the LICENSE file for more details. Quick Start 1. Install the required dependencies: 2. See available options: 3. To get more information on a Windows memory sample and to make sure Volatility supports that sample type, run vol -f windows.info : 4. Run some other plugins. The -f or --single-location is not strictly required, but most plugins expect a single sample. Some also require/accept other options. Run vol -h for more information on a particular command. I","default_branch":null,"files":null,"tree":[],"storefront":"/r/volatilityfoundation","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/volatilityfoundation/volatility3/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}