ISF: Support deprecating versions

volatility/framework/constants/__init__.py

@@ -84,3 +84,8 @@ class Parallelism(enum.IntEnum):
 
 PARALLELISM = Parallelism.Off
 """Default value to the parallelism setting used throughout volatility"""
+
+ISF_MINIMUM_SUPPORTED = (2, 0, 0)
+"""The minimum supported version of the Intermediate Symbol Format"""
+ISF_MINIMUM_DEPRECATED = (3, 9, 9)
+"""The highest version of the ISF that's deprecated (usually higher than supported)"""

volatility/framework/symbols/intermed.py

@@ -120,6 +120,11 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface):
         self._delegate = self._closest_version(metadata.get('format', "0.0.0"),
                                                self._versions)(context, config_path, name, json_object, native_types,
                                                                table_mapping)
+        if self._delegate.version < constants.ISF_MINIMUM_SUPPORTED:
+            raise RuntimeError("ISF version {} is no longer supported: {}".format(metadata.get('format', "0.0.0"),
+                                                                                  isf_url))
+        elif self._delegate.version < constants.ISF_MINIMUM_DEPRECATED:
+            vollog.warning("ISF version {} has been deprecated: {}".format(metadata.get('format', "0.0.0"), isf_url))
 
         # Inherit
         super().__init__(context,