{"id":13511125,"url":"https://github.com/volatilityfoundation/volatility3","last_synced_at":"2026-01-29T23:15:49.476Z","repository":{"id":13566058,"uuid":"16258388","full_name":"volatilityfoundation/volatility3","owner":"volatilityfoundation","description":"Volatility 3.0 development","archived":false,"fork":false,"pushed_at":"2025-05-01T16:50:04.000Z","size":9942,"stargazers_count":3057,"open_issues_count":138,"forks_count":501,"subscribers_count":59,"default_branch":"develop","last_synced_at":"2025-05-01T17:50:26.520Z","etag":null,"topics":["digital-investigation","forensics","incident-response","malware","memory","python","ram","volatility","volatility-framework"],"latest_commit_sha":null,"homepage":"http://volatilityfoundation.org/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"MoPSource/MopCore547","license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/volatilityfoundation.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":"CITATION.cff","codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2014-01-26T18:09:20.000Z","updated_at":"2025-05-01T16:50:04.000Z","dependencies_parsed_at":"2023-10-18T20:26:20.738Z","dependency_job_id":"6fc06f28-3f29-415f-a14c-62fb44be1f0c","html_url":"https://github.com/volatilityfoundation/volatility3","commit_stats":{"total_commits":3387,"total_committers":64,"mean_commits":52.921875,"dds":"0.26867434307646887","last_synced_commit":"a77a1ae301f9f00a2a073ff4b0eaff6644d732f8"},"previous_names":[],"tags_count":13,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/volatilityfoundation%2Fvolatility3","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/volatilityfoundation%2Fvolatility3/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/volatilityfoundation%2Fvolatility3/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/volatilityfoundation%2Fvolatility3/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/volatilityfoundation","download_url":"https://codeload.github.com/volatilityfoundation/volatility3/tar.gz/refs/heads/develop","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252522132,"owners_count":21761684,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["digital-investigation","forensics","incident-response","malware","memory","python","ram","volatility","volatility-framework"],"created_at":"2024-08-01T03:00:35.001Z","updated_at":"2026-01-29T23:15:49.431Z","avatar_url":"https://github.com/volatilityfoundation.png","language":"Python","readme":"# Volatility 3: The volatile memory extraction framework\n\nVolatility is the world's most widely used framework for extracting digital\nartifacts from volatile memory (RAM) samples. The extraction techniques are\nperformed completely independent of the system being investigated but offer\nvisibility into the runtime state of the system. The framework is intended\nto introduce people to the techniques and complexities associated with\nextracting digital artifacts from volatile memory samples and provide a\nplatform for further work into this exciting area of research.\n\nIn 2019, the Volatility Foundation released a complete rewrite of the\nframework, Volatility 3. The project was intended to address many of the\ntechnical and performance challenges associated with the original\ncode base that became apparent over the previous 10 years. Another benefit\nof the rewrite is that Volatility 3 could be released under a custom\nlicense that was more aligned with the goals of the Volatility community,\nthe Volatility Software License (VSL). See the\n[LICENSE](https://www.volatilityfoundation.org/license/vsl-v1.0) file for\nmore details.\n\n## Quick Start\n\n1. Install the required dependencies:\n\n    ```shell\n    pip install --user -e \".[full]\"\n    ```\n\n2. See available options:\n\n    ```shell\n    vol -h\n    ```\n\n3. To get more information on a Windows memory sample and to make sure Volatility supports that sample type, run `vol -f \u003cimagepath\u003e windows.info`:\n\n    ```shell\n    vol -f /home/user/samples/stuxnet.vmem windows.info\n    ```\n\n4. Run some other plugins. The `-f` or `--single-location` is not strictly required, but most plugins expect a single sample.\nSome also require/accept other options.  Run `vol \u003cplugin\u003e -h` for more information on a particular command.\n\n## Installing\n\nVolatility 3 requires Python 3.8.0 or later and is published on the [PyPi registry](https://pypi.org/project/volatility3).\n\n```shell\npip install volatility3\n```\n\nIf you want to use the latest development version of Volatility 3 we recommend you manually clone this repository and install an editable version of the project.\nWe recommend you use a virtual environment to keep installed dependencies separate from system packages.\n\nThe latest stable version of Volatility will always be the `stable` branch of the GitHub repository. The default branch is `develop`.\n\n```shell\ngit clone https://github.com/volatilityfoundation/volatility3.git\ncd volatility3/\npython3 -m venv venv \u0026\u0026 . venv/bin/activate\npip install -e \".[dev]\"\n```\n\n## Symbol Tables\n\nSymbol table packs for the various operating systems are available for download at:\n\n\u003chttps://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip\u003e\n\n\u003chttps://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip\u003e\n\n\u003chttps://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip\u003e\n\nThe hashes to verify whether any of the symbol pack files have downloaded successfully or have changed can be found at:\n\n\u003chttps://downloads.volatilityfoundation.org/volatility3/symbols/SHA256SUMS\u003e\n\n\u003chttps://downloads.volatilityfoundation.org/volatility3/symbols/SHA1SUMS\u003e\n\n\u003chttps://downloads.volatilityfoundation.org/volatility3/symbols/MD5SUMS\u003e\n\nSymbol tables zip files must be placed, as named, into the `volatility3/symbols` directory (or just the symbols directory next to the executable file).\n\nWindows symbols that cannot be found will be queried, downloaded, generated and cached.  Mac and Linux symbol tables must be manually produced by a tool such as [dwarf2json](https://github.com/volatilityfoundation/dwarf2json).\n\nImportant: The first run of volatility with new symbol files will require the cache to be updated.  The symbol packs contain a large number of symbol files and so may take some time to update!\nHowever, this process only needs to be run once on each new symbol file, so assuming the pack stays in the same location will not need to be done again.  Please also note it can be interrupted and next run will restart itself.\n\nPlease note: These are representative and are complete up to the point of creation for Windows and Mac.  Due to the ease of compiling Linux kernels and the inability to uniquely distinguish them, an exhaustive set of Linux symbol tables cannot easily be supplied.\n\n## Documentation\n\nThe framework is documented through doc strings and can be built using sphinx.\n\nThe latest generated copy of the documentation can be found at: \u003chttps://volatility3.readthedocs.io/en/latest/\u003e\n\n## Licensing and Copyright\n\nCopyright (C) 2007-2026 Volatility Foundation\n\nAll Rights Reserved\n\n\u003chttps://www.volatilityfoundation.org/license/vsl-v1.0\u003e\n\n## Bugs and Support\n\nIf you think you've found a bug, please report it at:\n\n\u003chttps://github.com/volatilityfoundation/volatility3/issues\u003e\n\nIn order to help us solve your issues as quickly as possible,\nplease include the following information when filing a bug:\n\n- The version of Volatility you're using\n- The operating system used to run Volatility\n- The version of Python used to run Volatility\n- The suspected operating system of the memory sample\n- The complete command line you used to run Volatility\n\nFor community support, please join us on Slack:\n\n\u003chttps://www.volatilityfoundation.org/slack\u003e\n\n## Contact\n\nFor information or requests, contact:\n\nVolatility Foundation\n\nWeb: \u003chttps://www.volatilityfoundation.org\u003e\n\nBlog:     \u003chttps://volatility-labs.blogspot.com\u003e\n\nEmail: volatility (at) volatilityfoundation (dot) org\n\nTwitter: [@volatility](https://twitter.com/volatility)\n","funding_links":[],"categories":["Frameworks","IR Tools Collection","Volatility 3","Exploitation Tools","Tool","Python","malware","其他_安全与渗透","\u003ca id=\"4d2a33083a894d6e6ef01b360929f30a\"\u003e\u003c/a\u003eVolatility"],"sub_categories":["Memory Analysis Tools","Books","Unikernel-like","Memory Analysis","资源传输下载"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvolatilityfoundation%2Fvolatility3","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvolatilityfoundation%2Fvolatility3","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvolatilityfoundation%2Fvolatility3/lists"}