{
  "added_at": "2026-11-09",
  "category": "dynamic-analysis",
  "description_en": "Inspect operating-system memory samples to recover processes, modules and other runtime artifacts through forensic plugins.",
  "description_zh": "通过取证插件检查操作系统内存样本，恢复进程、模块及其他运行时制品。",
  "entry_url": "https://awesomerea.org/resources/volatility3/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/volatility3/",
  "evidence_url": "https://github.com/volatilityfoundation/volatility3/blob/77ff0b1932d77527f850c8ced01d85805ea7bf97/README.md",
  "group": "tools",
  "id": "volatility3",
  "json_url": "https://awesomerea.org/resources/volatility3/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/volatility3/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/volatility3/index.md",
  "name": "Volatility 3",
  "name_zh": "Volatility 3",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Requires a supported memory image, appropriate symbol tables and Python; the pinned README specifies Python 3.8+. The default branch is develop, while stable is the release branch.",
    "Windows symbols may be downloaded and cached automatically; Linux and macOS symbols can need manual generation with matching kernel information. The project uses the custom Volatility Software License."
  ],
  "requirements_zh": [
    "需要受支持的内存镜像、合适的符号表及 Python；固定版本 README 列出 Python 3.8+。默认分支为 develop，stable 为稳定发行分支。",
    "Windows 符号可能自动下载并缓存；Linux 和 macOS 符号可能需要依据匹配的内核信息手动生成。项目采用自定义 Volatility Software License。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/volatilityfoundation/volatility3",
  "verification": "source-reviewed",
  "verified_at": "2026-10-29"
}