Tool

Volatility 3

Inspect operating-system memory samples to recover processes, modules and other runtime artifacts through forensic plugins.

Targets: Binary
Category: Debugging and dynamic analysis
Relationship: Foundation tool
Sources reviewed: 2026-10-29

Stars: 4.6k
Last commit: 2026-10-12
Language: Python

GitHub data as of 2026-11-09

Copy as Markdown View JSON Cite

Requirements & limits

Requires a supported memory image, appropriate symbol tables and Python; the pinned README specifies Python 3.8+. The default branch is develop, while stable is the release branch.
Windows symbols may be downloaded and cached automatically; Linux and macOS symbols can need manual generation with matching kernel information. The project uses the custom Volatility Software License.

Cite

BibTeX

@misc{volatility3,
  title = {{Volatility 3}},
  howpublished = {\url{https://github.com/volatilityfoundation/volatility3}},
  url = {https://github.com/volatilityfoundation/volatility3},
  urldate = {2026-10-29},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/volatility3/}}
}

Plain text

Volatility 3. https://github.com/volatilityfoundation/volatility3 (accessed 2026-10-29). Awesome REA entry: https://awesomerea.org/resources/volatility3/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · volatilityfoundation/volatility3 · Revision 77ff0b1