LoginSign Up
← Back to all sparks
V

Volatility

INFRA · APIS
Velocity0.0

Memory forensics framework for incident response

www.volatilityfoundation.org ↗

Volatility 3 2.28.2 adds Mermaid tree output and starts deprecating macOS analysis.

memory-forensicslinux-coveragestructured-outputmacos deprecationplugins
◆Current state
Volatility 3 reached functional parity with Volatility 2 in 2.26.0, then reorganised malware plugins into their own namespace and added an arrow/parquet renderer. 2.28.0 in April brought Linux sockscan and process_spoofing. 2.28.2 in September adds a Mermaid renderer for tree relationships, lets Linux malfind dump enumerated VMAs, verifies Intel layers with translation checks, and adds a deprecation warning for macOS analysis.
◆Where it's heading
Development is narrowing toward Windows and Linux, with output formats that feed other tools. The macOS warning is the first sign of support being cut back.
◆Prediction
Expect macOS analysis support to be reduced or removed in a later release; the entries don't say when.

◆Recent moves

  1. 1mo ago

    Volatility 3 2.28.2: Mermaid output, macOS deprecation warning

    Adds a Mermaid renderer for tree relationships, lets Linux malfind dump enumerated pages, and warns that macOS analysis is deprecated. Arrow output is dropped from the standalone executable to keep it small.

    View source ↗
  2. 6mo ago

    2.28.0 adds sockscan and process_spoofing, improves Intel scanning

    Linux gains sockscan and process_spoofing plugins plus stronger VMA enumeration smearing protection, and the Intel layer's address space scanning improves. The kind of incremental coverage growth that follows the parity milestone.

    View source ↗
  3. 9mo ago

    2.27.0 adds an arrow/parquet renderer and pebmasquerade

    An arrow/parquet output renderer arrives, making analysis results loadable by data tooling rather than only readable, and a Windows executable joins the release cycle. Both point at Volatility being run by pipelines instead of analysts alone. A known Windows 11 image issue is documented rather than hidden.

    View source ↗
  4. 1y ago

    2.26.2 moves malware plugins into their own namespace

    ⚡ SPARK

    Malware-specific plugins are relocated under a malware namespace — linux.check_afinfo becomes linux.malware.check_afinfo — with old names deprecated for roughly a year and warning when used. volshell also gains breakpoints. It is the first release to treat plugin naming as a stable interface with a migration cost.

    View source ↗
  5. 1y ago

    2.26.0 reaches functional parity with Volatility 2

    ⚡ SPARK

    Around twenty plugins land in one release — Linux tracing via ftrace, perf events and tracepoints, kallsyms, module extraction, graphics fbdev, Windows direct and indirect system calls, desktop scanning, regex scanning across platforms — explicitly to match the archived Volatility 2. It is the release that removes the reason to stay on the old version.

    View source ↗
  6. 1y ago

    2.11.0 adds fifteen plugins and raises the Python floor to 3.8

    A broad plugin batch — Linux eBPF, hidden modules, page cache, ptrace, kernel threads; Windows amcache, consoles, scheduled tasks, PE symbols, orphan kernel threads — with CLI output formatting and filtering improved alongside. Python 3.8 becomes the minimum.

    View source ↗