Volatility (memory forensics)
Volatility is an open-source memory forensics framework for incident response and malware analysis. It is written in Python and supports Microsoft Windows, Mac OS X, and Linux.
Volatility was created by computer scientist and entrepreneur Aaron Walters, drawing on academic research he did in memory forensics.Volatility supports investigations of the following memory images:
Windows:
Mac OSX:
- 32-bit 10.5.x Leopard
- 32-bit 10.6.x Snow Leopard
- 32-bit 10.7.x Lion
- 64-bit 10.6.x Snow Leopard
- 64-bit 10.7.x Lion
- 64-bit 10.8.x Mountain Lion
- 64-bit 10.9.x Mavericks
- 64-bit 10.10.x Yosemite
- 64-bit 10.11.x El Capitan
- 64-bit 10.12.x Sierra
Linux:
- 32-bit Linux kernels 2.6.11 to 4.2.3
- 64-bit Linux kernels 2.6.11 to 4.2.3
- OpenSuSE, Ubuntu, Debian, CentOS, Fedora, Mandriva, etc.
Memory Format Support
Volatility supports a variety of sample file formats and the ability to convert between these formats:
