LoginSign Up
← Back to all sparks
V

Volatility

INFRA · APIS
Velocity0.0

Memory forensics framework for incident response

www.volatilityfoundation.org ↗

Volatility 3 caught up with Volatility 2, then started reorganising itself.

memory-forensicsplugin-taxonomylinux-coveragestructured-outputvolatility2-parity
◆Current state
The 2.26.0 release was explicitly aimed at functional parity with the archived Volatility 2, landing around twenty plugins at once across Linux, macOS and Windows. Since then the work has shifted from filling gaps to structuring what exists: malware-specific plugins moved under a malware namespace with the old names deprecated, an arrow/parquet output renderer added, volshell given breakpoints, and per-release additions like sockscan, process_spoofing, pebmasquerade and etwpatch.
◆Where it's heading
Two things are happening at once. The plugin catalogue keeps growing on the Linux side in particular — tracing, kallsyms, ftrace, VMA scanning, smearing protection — reflecting where memory forensics currently has the least coverage. And the framework is being made into something other tools consume: structured output formats, a shipped Windows executable, a namespaced plugin taxonomy with a year-long deprecation window. The project is treating plugin names as an interface it owes users stability on.
◆Prediction
Expect the malware namespace migration to complete as the deprecated names age out, and the Linux plugin surface to keep taking the bulk of new additions, with output-format work continuing to open the framework to automated pipelines.

◆Recent moves

  1. 3mo ago

    2.28.0 adds sockscan and process_spoofing, improves Intel scanning

    Linux gains sockscan and process_spoofing plugins plus stronger VMA enumeration smearing protection, and the Intel layer's address space scanning improves. The kind of incremental coverage growth that follows the parity milestone.

    View source ↗
  2. 6mo ago

    2.27.0 adds an arrow/parquet renderer and pebmasquerade

    An arrow/parquet output renderer arrives, making analysis results loadable by data tooling rather than only readable, and a Windows executable joins the release cycle. Both point at Volatility being run by pipelines instead of analysts alone. A known Windows 11 image issue is documented rather than hidden.

    View source ↗
  3. 10mo ago

    2.26.2 moves malware plugins into their own namespace

    ⚡ SPARK

    Malware-specific plugins are relocated under a malware namespace — linux.check_afinfo becomes linux.malware.check_afinfo — with old names deprecated for roughly a year and warning when used. volshell also gains breakpoints. It is the first release to treat plugin naming as a stable interface with a migration cost.

    View source ↗
  4. 1y ago

    2.26.0 reaches functional parity with Volatility 2

    ⚡ SPARK

    Around twenty plugins land in one release — Linux tracing via ftrace, perf events and tracepoints, kallsyms, module extraction, graphics fbdev, Windows direct and indirect system calls, desktop scanning, regex scanning across platforms — explicitly to match the archived Volatility 2. It is the release that removes the reason to stay on the old version.

    View source ↗
  5. 1y ago

    2.11.0 adds fifteen plugins and raises the Python floor to 3.8

    A broad plugin batch — Linux eBPF, hidden modules, page cache, ptrace, kernel threads; Windows amcache, consoles, scheduled tasks, PE symbols, orphan kernel threads — with CLI output formatting and filtering improved alongside. Python 3.8 becomes the minimum.

    View source ↗
  6. 1y ago

    2.8.0 adds vmscan and a batch of Windows injection plugins

    Fifteen plugins including vmscan and a cluster aimed at process injection and service tampering — hollowprocesses, processghosting, psxview, svcdiff, suspicious_threads. Smear protection on Windows and Intel layer work accompany them.

    View source ↗