============================================================================

Volatility 3: The volatile memory extraction framework

============================================================================



Volatility is the world’s most widely used framework for extracting digital

artifacts from volatile memory (RAM) samples. The extraction techniques are

performed completely independent of the system being investigated but offer

visibility into the runtime state of the system. The framework is intended

to introduce people to the techniques and complexities associated with

extracting digital artifacts from volatile memory samples and provide a

platform for further work into this exciting area of research.



In 2019, the Volatility Foundation released a complete rewrite of the

framework, Volatility 3. The project was intended to address many of the

technical and performance challenges associated with the original

code base that became apparent over the previous 10 years. Another benefit

of the rewrite is that Volatility 3 could be released under a custom

license that was more aligned with the goals of the Volatility community,

the Volatility Software License (VSL). See the LICENSE file for more details.



Requirements

============



- Python 3.5.3 or later. http://www.python.org

- Pefile 2017.8.1 or later. https://pypi.org/project/pefile/



Optional Dependencies

=====================



- yara-python 3.8.0 or later. https://github.com/VirusTotal/yara-python

- capstone 3.0.0 or later. https://www.capstone-engine.org/download.html



Downloading Volatility

======================



The latest stable version of Volatility will always be the master

branch of the GitHub repository. You can get the latest version of

the code using the following command:



git clone https://github.com/volatilityfoundation/volatility3.git



Quick Start

===========



1. Clone the latest version of Volatility from GitHub:



    git clone https://github.com/volatilityfoundation/volatility3.git



2. To see available options, run "python vol.py -h"



3. To get more information on a Windows memory sample and to make sure

Volatility supports that sample type, run

'python -f <imagepath> windows.info’



   Example:



    $ python vol.py —f /home/user/samples/stuxnet.vmem windows.info



4. Run some other plugins. The -f or —-single-location is not strictly

required, but most plugins expect a single sample. Some also

require/accept other options.  Run "python vol.py <plugin> -h"

for more information on a particular command.



Licensing and Copyright

=======================



Copyright (C) 2007-2019 Volatility Foundation



All Rights Reserved



https://www.volatilityfoundation.org/license/vsl_v1.0



Bugs and Support

================



If you think you've found a bug, please report it at:



    https://github.com/volatilityfoundation/volatility3/issues



In order to help us solve your issues as quickly as possible,

please include the following information when filing a bug:



* The version of Volatility you're using

* The operating system used to run Volatility

* The version of Python used to run Volatility

* The suspected operating system of the memory sample

* The complete command line you used to run Volatility



Contact

=======



For information or requests, contact:



Volatility Foundation



Web: http://www.volatilityfoundation.org

     http://volatility-labs.blogspot.com



Email: volatility (at) volatilityfoundation (dot) org



Twitter: @volatility