Volatility 3

No entries match these filters. Clear filters

1. v2.28.2 Sep 17, 2026 · issue 078

   Volatility 3 v2.28.2 adds a Mermaid renderer for tree visualization and expands Linux malfind's VMA dumping options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.28.2 https://github.com/volatilityfoundation/volatility3.git
   # already have the repo? check out this version:
   $ git checkout v2.28.2

   └──▷ TRY IT
   Visualize the Windows process tree as a Mermaid diagram to paste directly into a GitHub incident-report or Markdown wiki page.
   copy

   $ vol -f /cases/memory.raw --renderer mermaid windows.pstree

   • Adds mermaid renderer (--renderer mermaid) for visualizing tree-structured plugin output (process trees, VAD trees) as Mermaid diagrams embeddable in Markdown and GitHub.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Replaces --dump-page and --dump-size with --show-all-dirty-pages and --hexdump-size in Linux malfind, giving finer control over dirty-page enumeration output.
   • Improves Windows Intel layer validation by verifying layers via translation checks, increasing accuracy of memory layer identification.
   • Redirects the Volatility banner to stderr when a structured-output renderer (such as mermaid, CSV, or JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory.) is in use, preventing banner text from corrupting piped output.
   • Adds mermaid renderer (--renderer mermaid) for visualizing tree-structured plugin output (process trees, VAD trees) as Mermaid diagrams embeddable in Markdown and GitHub.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Linux malfind option --dump-page is replaced by --show-all-dirty-pages; scripts or workflows using --dump-page will break.
   • !Linux malfind option --dump-size is replaced by --hexdump-size; scripts or workflows using --dump-size will break.
   • !Arrow/Parquet output renderer is removed from the standalone executable build; users relying on Arrow output in the EXE must switch to the pip-installed package.
2. docs update Aug 17, 2026 · issue 048

   Volatility 3 adds an optional Arrow/Parquet format renderer for output via the pyarrow dependency.

3. v2.28.0 Apr 30, 2026 · release notes

   Volatility 3 v2.28.0 adds Linux sockscan and process-spoofing plugins, Windows banner support, and improved Windows 11 detection.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.28.0 https://github.com/volatilityfoundation/volatility3.git
   # already have the repo? check out this version:
   $ git checkout v2.28.0

   • Adds linux.sockscan plugin for scanning Linux memory for network socket artifacts.
   • Adds linux.process_spoofing plugin to detect process parent-PID spoofing on Linux.
   • Adds Windows support to the banners plugin for identifying Windows memory images.
   • Enhances Linux VMA enumeration smearing protection for more robust analysis of volatile memory.
   • Handles new bin_attribute format for Linux kernel module sections.

   +2 more show less

   • Improves Windows Intel detection with better Windows 11 support.
   • Supports Cryptodome namespace as a fallback when the Crypto package is unavailable.

   7 details in Everything

4. v2.27.0 Jan 29, 2026 · release notes

   Volatility 3 v2.27.0 adds PEB masquerade detection, Arrow/Parquet output, and enhanced DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls./VAD plugins.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.27.0 https://github.com/volatilityfoundation/volatility3.git
   # already have the repo? check out this version:
   $ git checkout v2.27.0

   • Adds Arrow/Parquet format renderer for structured, columnar output of analysis results.
   • Enhances windows.dlllist plugin with improved capabilities.
   • Improves linux.malfind and linux.lsof plugins.
   • Windows executable binary now included as part of the official release cycle.

   4 details in Everything

5. v2.26.2 Sep 25, 2025 · release notes

   Volatility 3 v2.26.2 adds windows.etwpatch plugin, volshell breakpoints, and reorganizes malware plugins under a dedicated category.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.26.2 https://github.com/volatilityfoundation/volatility3.git
   # already have the repo? check out this version:
   $ git checkout v2.26.2

   └──▷ TRY IT
   Detect ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. patching on a Windows memory image to uncover malware that blinds event tracing.
   copy

   $ vol -f <memory.img> windows.etwpatch

   • New windows.etwpatch plugin for detecting ETW (Event Tracing for Windows) patching.
   • Adds breakpoint/watchpoint support in volshell — set a breakpoint on a specific layer and offset to drop into Python when that memory location is read.
   • Reorganizes malware-focused plugins under a malware subcategory (e.g., linux.malware.check_afinfo, windows.malware.hollowprocesses) for cleaner namespacing.

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Plugin names such as linux.check_afinfo and windows.hollowprocesses are deprecated and moved to linux.malware.check_afinfo and windows.malware.hollowprocesses; old names will continue to work for approximately one year but will print deprecation warnings, and will be removed after that period.
6. v2.26.0 May 16, 2025 · release notes

   Volatility 3 v2.26.0 adds 19 new plugins spanning Linux tracing, Windows GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands./syscall analysis, and regex scanning across platforms.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.26.0 https://github.com/volatilityfoundation/volatility3.git
   # already have the repo? check out this version:
   $ git checkout v2.26.0

   • New linux.graphics.fbdev plugin for Linux framebuffer device analysis.
   • New linux.ip plugin for Linux IP networking artifact enumeration.
   • New linux.kallsyms plugin to extract kernel symbol table information.
   • New linux.module_extract plugin to dump Linux kernel modules from memory.
   • New linux.modxview plugin for cross-referencing loaded kernel modules.

   +14 more show less

   • New linux.pscallstack plugin to inspect process call stacks on Linux.
   • New linux.tracing.ftrace plugin for analyzing Linux ftrace tracing infrastructure.
   • New linux.tracing.perf_events plugin for examining Linux perf event subsystem artifacts.
   • New linux.tracing.tracepoints plugin to enumerate Linux kernel tracepoints.
   • New linux.vmaregexscan plugin to regex-scan virtual memory areas on Linux.
   • New linux.vmcoreinfo plugin to extract vmcoreinfo data from Linux memory images.
   • New mac.regexscan plugin for regex scanning across macOS memory.
   • New windows.deskscan plugin to enumerate Windows desktop objects.
   • New windows.desktops plugin for Windows desktop enumeration.
   • New windows.direct_system_calls plugin to detect direct syscall usage (potential evasion indicator).
   • New windows.indirect_system_calls plugin to detect indirect syscall usage (potential evasion indicator).
   • New windows.suspended_threads plugin to identify suspended threads on Windows.
   • New windows.vadregexscan plugin for regex scanning across Windows VAD regions.
   • New windows.windows and windows.windowstations plugins to enumerate GUI windows and window stations.

   19 details in Everything

7. v2.11.0 Jan 16, 2025 · release notes

   Volatility 3 v2.11.0 adds 14 new plugins spanning Linux eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic., hidden modules, ptrace, and Windows scheduled tasks, amcache, and more.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.11.0 https://github.com/volatilityfoundation/volatility3.git
   # already have the repo? check out this version:
   $ git checkout v2.11.0

   • New linux.boottime plugin to retrieve system boot time from a Linux memory image.
   • New linux.hidden_modules plugin to detect kernel modules hidden from the standard module list.
   • New linux.kthreads plugin to list kernel threads running on a Linux system.
   • New linux.pagecache plugin to inspect the Linux page cache.
   • New linux.pidhashtable plugin to enumerate processes via the PID hash table, aiding detection of hidden processes.

   +7 more show less

   • New linux.ptrace plugin to identify processes being traced via ptrace.
   • New windows.debugregisters plugin to inspect hardware debug registers across processes.
   • New windows.orphan_kernel_threads plugin to detect kernel threads with no owning process — a common rootkit indicator.
   • New windows.pe_symbols plugin to resolve and display symbols from PE images in memory.
   • New windows.scheduled_tasks plugin to extract scheduled task definitions from Windows memory.
   • Improved output formatting and filtering in the CLI.
   • Additional architecture data files added for vmscan.

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.8 is now the minimum supported version; environments running Python 3.7 or earlier will no longer work.
8. v2.8.0 Oct 9, 2024 · release notes

   Volatility 3 v2.8.0 adds 15 new plugins including hollow process, process ghosting, and netfilter detection.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.8.0 https://github.com/volatilityfoundation/volatility3.git
   # already have the repo? check out this version:
   $ git checkout v2.8.0

   └──▷ TRY IT
   Detect process ghosting — a technique that evades AV/EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. by deleting the executable before process creation — during incident response.
   copy

   $ vol -f <memory.dump> windows.processghosting

   Find hidden processes by cross-referencing multiple process enumeration sources, surfacing rootkit-concealed entries.
   copy

   $ vol -f <memory.dump> windows.psxview

   Inspect Linux netfilter hooks to detect kernel-level packet interception or rootkit hooks on a Linux memory image.
   copy

   $ vol -f <memory.dump> linux.netfilter

   • New vmscan plugin for memory scan analysis.
   • New linux.netfilter plugin to inspect Linux netfilter hooks.
   • New windows.hollowprocesses plugin to detect process hollowing.
   • New windows.kpcrs plugin to enumerate Kernel Processor Control Regions.
   • New windows.pedump plugin to dump PE images from memory.

   +13 more show less

   • New windows.processghosting plugin to detect process ghosting attacks.
   • New windows.psxview plugin for cross-view process listing to find hidden processes.
   • New windows.registry.getcellroutine plugin to inspect registry cell routines.
   • New windows.shimcachemem plugin to extract shim cache artifacts from memory.
   • New windows.suspicious_threads plugin to identify suspicious thread activity.
   • New windows.svcdiff plugin to compare service listings and detect discrepancies.
   • New windows.svclist plugin to enumerate Windows services.
   • New windows.threads plugin to list process threads.
   • New windows.timers plugin to enumerate kernel timers.
   • New windows.unloadedmodules plugin to list previously unloaded kernel modules.
   • Adds timeliner support to the userassist plugin.
   • Expands windows.callbacks plugin to support additional callback types.
   • Adds argcomplete support for shell tab-completion of Volatility commands.

   18 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Volatility 3 now requires Python >= 3.7.3; environments running older Python versions will break on upgrade.
9. v2.7.0 May 29, 2024 · release notes

   Volatility 3 v2.7.0 adds windows.iat plugin and configuration file support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.7.0 https://github.com/volatilityfoundation/volatility3.git
   # already have the repo? check out this version:
   $ git checkout v2.7.0

   • Adds windows.iat plugin for displaying the Import Address Table
   • Supports loading common CLI options from configuration files instead of arguments
   • Adds linux.library_list plugin to list loaded libraries
   • Adds mac.dmesg plugin to view kernel messages
   • Adds mac.maps process dump support via the mac.maps plugin

   5 details in Everything

10. v2.5.2 Jan 31, 2024 · release notes

    Volatility 3 v2.5.2 adds Amazon S3 and Google Cloud Storage layers, new plugins, and ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. dumping

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.2 https://github.com/volatilityfoundation/volatility3.git
    # already have the repo? check out this version:
    $ git checkout v2.5.2

    • Adds s3 layer for Amazon S3 support
    • Adds gcs layer for Google Cloud Storage support
    • Adds linux.vmayarascan plugin
    • Adds windows.mftscan.ads plugin
    • Enables dumping of Elf files in the elfs plugin

    5 details in Everything

11. v2.5.0 Sep 27, 2023 · release notes

    Volatility 3 v2.5.0 adds Linux capabilities plugin, Linux process dumping, and Xen ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.0 https://github.com/volatilityfoundation/volatility3.git
    # already have the repo? check out this version:
    $ git checkout v2.5.0

    └──▷ USE IT
    Analyze the capabilities of a process in a Linux memory dump.
    shell copy

    vol.py -f linux_dump.img linux_capabilities

    Dump the memory of a specific process (PID 1234) from a Linux memory image.
    shell copy

    vol.py -f linux_dump.img linux_process_dump --pid 1234

    • New linux_capabilities plugin added to list and analyze Linux capabilities for processes.
    • New linux_process_dump plugin enables dumping memory of specific Linux processes.
    • Add support for Xen ELF file format in image detection and loading.

    3 details in Everything

12. v2.4.1 Apr 12, 2023 · release notes

    Adds six new Volatility 3 plugins for Linux and Windows memory analysis

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.1 https://github.com/volatilityfoundation/volatility3.git
    # already have the repo? check out this version:
    $ git checkout v2.4.1

    └──▷ HOW TO FIND IT
    Analyze open network sockets in a Linux memory dump
    📍vol -f linux.dump linux.sockstat
    Walk virtual address descriptors in a Windows memory dump
    📍vol -f windows.dump windows.vadwalk
    • Adds linux.sockstat plugin to list open sockets on Linux
    • Adds linux.iomem plugin to view I/O memory regions on Linux
    • Adds linux.psscan plugin to scan process structures on Linux
    • Adds linux.envars plugin to extract environment variables on Linux
    • Adds windows.drivermodule plugin to enumerate driver modules on Windows

    +1 more show less

    • Adds windows.vadwalk plugin to walk VADs on Windows

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Minimum Python version is now 3.7
13. v2.4.0 Dec 14, 2022 · release notes

    Volatility 3 v2.4.0 adds linux.mountinfo, windows.devicetree, and several new Windows/Linux plugins plus an automatic PDBPDBA debug symbol file format used by Microsoft's toolchain that maps compiled binaries back to source code, function names, and variable types, letting cyber tools resolve symbols during reverse engineering or memory analysis. API

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.0 https://github.com/volatilityfoundation/volatility3.git
    # already have the repo? check out this version:
    $ git checkout v2.4.0

    └──▷ USE IT
    Extract mount information from a Linux memory dump using the new linux.mountinfo plugin.
    shell copy

    volatility -f linux.dump linux.mountinfo

    List Windows sessions from a memory dump using the new windows.sessions plugin.
    shell copy

    volatility -f windows.dump windows.sessions

    Parse the device object tree from a Windows memory dump using the new windows.devicetree plugin.
    shell copy

    volatility -f windows.dump windows.devicetree

    • Adds linux.mountinfo plugin to extract mount information from Linux memory dumps
    • Adds linux.psaux plugin to list Linux processes and their parent-child relationships
    • Adds windows.devicetree plugin to parse the Windows device object tree
    • Adds windows.joblinks plugin to enumerate job objects and process links
    • Adds windows.ldrmodules plugin to load linked lists for module enumeration

    +7 more show less

    • Adds windows.mbrscan plugin to scan for Master Boot Records in memory
    • Adds windows.mftscan plugin to scan for MFT entries in memory
    • Adds windows.sessions plugin to list Windows session information
    • Introduces the concept of modules and module requirements for extensibility
    • Unifies symbol handling and ISF file caching across OS versions for better compatibility
    • Improves QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. QEVM support by fixing the PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. hole issue
    • Exposes an API for automatic PDB symbol table use

    12 details in Everything

14. v2.0.0 Jan 12, 2022 · release notes

    Volatility 3 v2.0.0 adds Windows networking/skeleton_key_check plugins, Linux kmsg plugin, AVML/LeechCore layers, and drops Python 3.5 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0 https://github.com/volatilityfoundation/volatility3.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0

    • Adds crashinfo Windows plugin for extracting crash information
    • Adds skeleton_key_check Windows plugin for detecting skeleton key attacks
    • Adds new kmsg Linux plugin for reading kernel messages
    • Adds AVML layer support for acquiring memory dumps via AVML
    • Adds LeechCore layer support for memory acquisition via LeechCore

    +1 more show less

    • Drops Python 3.5 support (requires Python >= 3.6)

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Python 3.5 is no longer supported; you must upgrade your runtime environment to Python 3.6 or newer to run this version of the cyber tool.
15. v1.0.0 Feb 1, 2021 · release notes

    Volatility 3 v1.0.0 introduces official release with caching improvements, Windows symbol support, and generated documentation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.0 https://github.com/volatilityfoundation/volatility3.git
    # already have the repo? check out this version:
    $ git checkout v1.0.0

    • Adds caching of objects for significantly faster operation compared to volatility 2.
    • Adds direct download and conversion of symbols for Windows memory images.
    • Generates documentation directly from the codebase.

    3 details in Everything