Moved plugin output example above the feature explanation for better flow and clarity.
Simplified the description while retaining key points about process hierarchy and anomaly detection.
Recommend users first check this repository for pre-generated symbol tables by kernel version for popular Linux distributions before creating their own.
Update memory acquisition section: remove deprecated LiME reference
LiME has been removed from the documentation due to its unmaintained status. The section now highlights AVML as an actively maintained tool, and includes a general note encouraging users to verify tool compatibility.
- Added concluding section to guide users toward further plugin exploration
- Provided command to list all supported Linux plugins in Volatility 3
- Encouraged community contribution by highlighting the open-source nature of the project
- Linked to the official Volatility 3 GitHub repository for contributor reference
- Added new section for linux.malfind plugin under Using plugins
- Included example output showing detection of suspicious executable memory regions
- Explained how to interpret fields such as anonymous mapping, rwx protection, and disassembly
- Highlighted analysis tips for identifying potential code injection or fileless malware
- Added linux.ip.Addr and linux.ip.Link examples to the Using plugins section
- Highlighted the importance of network configuration in memory forensics
- Explained key fields such as interface state, MAC, IP, namespace, and flags
- Structured the content consistently alongside other plugin examples (pslist, bash, etc.)
- Updated linux.pslist output to include new fields: OFFSET, UID/GID, creation time, and file output
- Added detailed explanation of each column and its forensic significance
- Revised linux.pstree section to reflect new output format including OFFSET and hierarchical indentation
- Emphasized the utility of both plugins for process analysis and anomaly detection
- Added new section for linux.boottime plugin
- Demonstrated how to extract system boot time from memory
- Explained its relevance for timeline analysis and incident response
- Removed outdated instructions referencing the ISF server
- Updated guidance to reflect current method of manually generating ISF files
- Clarified placement of ISF files under volatility3/symbols for automatic detection
- Replaced outdated and partial plugin list with a concise summary
- Mentioned total number of supported Linux plugins (~40+)
- Highlighted representative plugins such as pslist, bash, lsmod, etc.
- Provided updated command to enumerate all available Linux plugins
- Removed outdated reference to the Linux ISF Server (service no longer available)
- Updated symbol table instructions to reflect current volatility3 behavior
(symbol files now auto-detected from volatility3/symbols directory)
This adds a new classmethod, `list_processes_from_kernel`, updates the
`list_processes` method signature to use only the kernel module name and
the context instead of splitting information about the kernel between
the layer_name and symbol_table_name paramters, and does a major version
number increase on the plugin.
Also updates the documentation to reflect pslist method signature
change.
Co-authored-by: Andrew Case <andrew@dfir.org>
