https://cybertoolchain.io/tools/volatility-3 New releases and features in Volatility 3, tracked by The Cyber Toolchain. en Thu, 17 Sep 2026 19:47:09 GMT https://github.com/volatilityfoundation/volatility3/releases/tag/v2.28.2 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.28.2 Thu, 17 Sep 2026 19:47:09 GMT Volatility 3 v2.28.2 adds a Mermaid renderer for tree visualization and expands Linux malfind's VMA dumping options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `mermaid` renderer (`--renderer mermaid`) for visualizing tree-structured plugin output (process trees, VAD trees) as Mermaid diagrams embeddable in Markdown and GitHub.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Replaces `--dump-page` and `--dump-size` with `--show-all-dirty-pages` and `--hexdump-size` in Linux `malfind`, giving finer control over dirty-page enumeration output. • Improves Windows Intel layer validation by verifying layers via translation checks, increasing accuracy of memory layer identification. • Redirects the Volatility banner to stderr when a structured-output renderer (such as `mermaid`, CSV, or JSONL) is in use, preventing banner text from corrupting piped output. Breaking changes: • Linux `malfind` option `--dump-page` is replaced by `--show-all-dirty-pages`; scripts or workflows using `--dump-page` will break. • Linux `malfind` option `--dump-size` is replaced by `--hexdump-size`; scripts or workflows using `--dump-size` will break. • Arrow/Parquet output renderer is removed from the standalone executable build; users relying on Arrow output in the EXE must switch to the pip-installed package. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/volatility-3 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.28.0 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.28.0 Thu, 30 Apr 2026 19:57:16 GMT Volatility 3 v2.28.0 adds Linux sockscan and process-spoofing plugins, Windows banner support, and improved Windows 11 detection. • Adds `linux.sockscan` plugin for scanning Linux memory for network socket artifacts. • Adds `linux.process_spoofing` plugin to detect process parent-PID spoofing on Linux. • Adds Windows support to the `banners` plugin for identifying Windows memory images. • Enhances Linux VMA enumeration smearing protection for more robust analysis of volatile memory. • Handles new `bin_attribute` format for Linux kernel module sections. • Improves Windows Intel detection with better Windows 11 support. • Supports `Cryptodome` namespace as a fallback when the `Crypto` package is unavailable. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/volatility-3 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.27.0 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.27.0 Thu, 29 Jan 2026 21:51:57 GMT Volatility 3 v2.27.0 adds PEB masquerade detection, Arrow/Parquet output, and enhanced DLL/VAD plugins. • Adds Arrow/Parquet format renderer for structured, columnar output of analysis results. • Enhances `windows.dlllist` plugin with improved capabilities. • Improves `linux.malfind` and `linux.lsof` plugins. • Windows executable binary now included as part of the official release cycle. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/volatility-3 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.26.2 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.26.2 Thu, 25 Sep 2025 20:51:37 GMT Volatility 3 v2.26.2 adds windows.etwpatch plugin, volshell breakpoints, and reorganizes malware plugins under a dedicated category. • New `windows.etwpatch` plugin for detecting ETW (Event Tracing for Windows) patching. • Adds breakpoint/watchpoint support in `volshell` — set a breakpoint on a specific layer and offset to drop into Python when that memory location is read. • Reorganizes malware-focused plugins under a `malware` subcategory (e.g., `linux.malware.check_afinfo`, `windows.malware.hollowprocesses`) for cleaner namespacing. Breaking changes: • Plugin names such as `linux.check_afinfo` and `windows.hollowprocesses` are deprecated and moved to `linux.malware.check_afinfo` and `windows.malware.hollowprocesses`; old names will continue to work for approximately one year but will print deprecation warnings, and will be removed after that period. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/volatility-3 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.26.0 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.26.0 Fri, 16 May 2025 13:24:53 GMT Volatility 3 v2.26.0 adds 19 new plugins spanning Linux tracing, Windows GUI/syscall analysis, and regex scanning across platforms. • New `linux.graphics.fbdev` plugin for Linux framebuffer device analysis. • New `linux.ip` plugin for Linux IP networking artifact enumeration. • New `linux.kallsyms` plugin to extract kernel symbol table information. • New `linux.module_extract` plugin to dump Linux kernel modules from memory. • New `linux.modxview` plugin for cross-referencing loaded kernel modules. • New `linux.pscallstack` plugin to inspect process call stacks on Linux. • New `linux.tracing.ftrace` plugin for analyzing Linux ftrace tracing infrastructure. • New `linux.tracing.perf_events` plugin for examining Linux perf event subsystem artifacts. • New `linux.tracing.tracepoints` plugin to enumerate Linux kernel tracepoints. • New `linux.vmaregexscan` plugin to regex-scan virtual memory areas on Linux. • New `linux.vmcoreinfo` plugin to extract vmcoreinfo data from Linux memory images. • New `mac.regexscan` plugin for regex scanning across macOS memory. • New `windows.deskscan` plugin to enumerate Windows desktop objects. • New `windows.desktops` plugin for Windows desktop enumeration. • New `windows.direct_system_calls` plugin to detect direct syscall usage (potential evasion indicator). • New `windows.indirect_system_calls` plugin to detect indirect syscall usage (potential evasion indicator). • New `windows.suspended_threads` plugin to identify suspended threads on Windows. • New `windows.vadregexscan` plugin for regex scanning across Windows VAD regions. • New `windows.windows` and `windows.windowstations` plugins to enumerate GUI windows and window stations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/volatility-3 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.11.0 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.11.0 Thu, 16 Jan 2025 20:24:58 GMT Volatility 3 v2.11.0 adds 14 new plugins spanning Linux eBPF, hidden modules, ptrace, and Windows scheduled tasks, amcache, and more. • New `linux.boottime` plugin to retrieve system boot time from a Linux memory image. • New `linux.hidden_modules` plugin to detect kernel modules hidden from the standard module list. • New `linux.kthreads` plugin to list kernel threads running on a Linux system. • New `linux.pagecache` plugin to inspect the Linux page cache. • New `linux.pidhashtable` plugin to enumerate processes via the PID hash table, aiding detection of hidden processes. • New `linux.ptrace` plugin to identify processes being traced via ptrace. • New `windows.debugregisters` plugin to inspect hardware debug registers across processes. • New `windows.orphan_kernel_threads` plugin to detect kernel threads with no owning process — a common rootkit indicator. • New `windows.pe_symbols` plugin to resolve and display symbols from PE images in memory. • New `windows.scheduled_tasks` plugin to extract scheduled task definitions from Windows memory. • Improved output formatting and filtering in the CLI. • Additional architecture data files added for `vmscan`. Breaking changes: • Python 3.8 is now the minimum supported version; environments running Python 3.7 or earlier will no longer work. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/volatility-3 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.8.0 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.8.0 Wed, 09 Oct 2024 22:28:48 GMT Volatility 3 v2.8.0 adds 15 new plugins including hollow process, process ghosting, and netfilter detection. • New `vmscan` plugin for memory scan analysis. • New `linux.netfilter` plugin to inspect Linux netfilter hooks. • New `windows.hollowprocesses` plugin to detect process hollowing. • New `windows.kpcrs` plugin to enumerate Kernel Processor Control Regions. • New `windows.pedump` plugin to dump PE images from memory. • New `windows.processghosting` plugin to detect process ghosting attacks. • New `windows.psxview` plugin for cross-view process listing to find hidden processes. • New `windows.registry.getcellroutine` plugin to inspect registry cell routines. • New `windows.shimcachemem` plugin to extract shim cache artifacts from memory. • New `windows.suspicious_threads` plugin to identify suspicious thread activity. • New `windows.svcdiff` plugin to compare service listings and detect discrepancies. • New `windows.svclist` plugin to enumerate Windows services. • New `windows.threads` plugin to list process threads. • New `windows.timers` plugin to enumerate kernel timers. • New `windows.unloadedmodules` plugin to list previously unloaded kernel modules. • Adds timeliner support to the `userassist` plugin. • Expands `windows.callbacks` plugin to support additional callback types. • Adds `argcomplete` support for shell tab-completion of Volatility commands. Breaking changes: • Volatility 3 now requires Python >= 3.7.3; environments running older Python versions will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/volatility-3 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.7.0 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.7.0 Wed, 29 May 2024 19:45:32 GMT Volatility 3 v2.7.0 adds windows.iat plugin and configuration file support • Adds `windows.iat` plugin for displaying the Import Address Table • Supports loading common CLI options from configuration files instead of arguments • Adds `linux.library_list` plugin to list loaded libraries • Adds `mac.dmesg` plugin to view kernel messages • Adds `mac.maps` process dump support via the mac.maps plugin Full history on Cyber Toolchain: https://cybertoolchain.io/tools/volatility-3 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.5.2 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.5.2 Wed, 31 Jan 2024 21:35:24 GMT Volatility 3 v2.5.2 adds Amazon S3 and Google Cloud Storage layers, new plugins, and ELF dumping • Adds `s3` layer for Amazon S3 support • Adds `gcs` layer for Google Cloud Storage support • Adds `linux.vmayarascan` plugin • Adds `windows.mftscan.ads` plugin • Enables dumping of Elf files in the `elfs` plugin Full history on Cyber Toolchain: https://cybertoolchain.io/tools/volatility-3 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.5.0 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.5.0 Wed, 27 Sep 2023 19:55:43 GMT Volatility 3 v2.5.0 adds Linux capabilities plugin, Linux process dumping, and Xen ELF support • New `linux_capabilities` plugin added to list and analyze Linux capabilities for processes. • New `linux_process_dump` plugin enables dumping memory of specific Linux processes. • Add support for Xen ELF file format in image detection and loading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/volatility-3 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.4.1 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.4.1 Wed, 12 Apr 2023 19:33:00 GMT Adds six new Volatility 3 plugins for Linux and Windows memory analysis • Adds `linux.sockstat` plugin to list open sockets on Linux • Adds `linux.iomem` plugin to view I/O memory regions on Linux • Adds `linux.psscan` plugin to scan process structures on Linux • Adds `linux.envars` plugin to extract environment variables on Linux • Adds `windows.drivermodule` plugin to enumerate driver modules on Windows • Adds `windows.vadwalk` plugin to walk VADs on Windows Breaking changes: • Minimum Python version is now 3.7 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/volatility-3 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.4.0 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.4.0 Wed, 14 Dec 2022 20:10:23 GMT Volatility 3 v2.4.0 adds linux.mountinfo, windows.devicetree, and several new Windows/Linux plugins plus an automatic PDB API • Adds `linux.mountinfo` plugin to extract mount information from Linux memory dumps • Adds `linux.psaux` plugin to list Linux processes and their parent-child relationships • Adds `windows.devicetree` plugin to parse the Windows device object tree • Adds `windows.joblinks` plugin to enumerate job objects and process links • Adds `windows.ldrmodules` plugin to load linked lists for module enumeration • Adds `windows.mbrscan` plugin to scan for Master Boot Records in memory • Adds `windows.mftscan` plugin to scan for MFT entries in memory • Adds `windows.sessions` plugin to list Windows session information • Introduces the concept of modules and module requirements for extensibility • Unifies symbol handling and ISF file caching across OS versions for better compatibility • Improves QEMU QEVM support by fixing the PCI hole issue • Exposes an API for automatic PDB symbol table use Full history on Cyber Toolchain: https://cybertoolchain.io/tools/volatility-3 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.0.0 https://github.com/volatilityfoundation/volatility3/releases/tag/v2.0.0 Wed, 12 Jan 2022 22:11:49 GMT Volatility 3 v2.0.0 adds Windows networking/skeleton_key_check plugins, Linux kmsg plugin, AVML/LeechCore layers, and drops Python 3.5 support • Adds `crashinfo` Windows plugin for extracting crash information • Adds `skeleton_key_check` Windows plugin for detecting skeleton key attacks • Adds new `kmsg` Linux plugin for reading kernel messages • Adds AVML layer support for acquiring memory dumps via AVML • Adds LeechCore layer support for memory acquisition via LeechCore • Drops Python 3.5 support (requires Python >= 3.6) Breaking changes: • Python 3.5 is no longer supported; you must upgrade your runtime environment to Python 3.6 or newer to run this version of the cyber tool. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/volatility-3