Difference between revisions of "Volatility Framework"

From ForensicsWiki
Jump to: navigation, search
m (updated for latest Volatility release information)
(Update website links.)
 
(16 intermediate revisions by one other user not shown)
Line 3: Line 3:
 
   maintainer = [[AAron Walters]] |
 
   maintainer = [[AAron Walters]] |
 
   os = {{Cross-platform}} |
 
   os = {{Cross-platform}} |
   genre = [[Memory analysis]] |
+
   genre = {{Memory analysis}} |
 
   license = {{GPL}} |
 
   license = {{GPL}} |
   website = [https://www.volatilesystems.com/default/volatility https://www.volatilesystems.com/] |
+
   website = [https://code.google.com/p/volatility/ https://code.google.com/p/volatility/] |
 
}}
 
}}
  
The '''Volatility Framework''' is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.  
+
The '''Volatility Framework''' is a completely open collection of tools, implemented in Python under the GNU General Public License (GPL v2), for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.
  
 
The project was originally developed by and is now headed up by [[AAron Walters]] of [[Volatile Systems]].
 
The project was originally developed by and is now headed up by [[AAron Walters]] of [[Volatile Systems]].
 +
 +
== Plugins ==
 +
See: [[List of Volatility Plugins]]
 +
 +
== Memory acquisition drivers ==
 +
 +
In 2012 [[Michael Cohen]] contributed both a Linux and a Windows Open Source memory (acquisition) driver to the Volatility project as part of the Technology Preview (TP) version, aka scudette branch.
 +
Since the scudette branch of Volatility has moved on as a separate project, the drivers can now be found as part of the [[rekall]] project.
  
 
== See Also ==
 
== See Also ==
Line 16: Line 24:
  
 
== External Links ==
 
== External Links ==
* [https://www.volatilesystems.com/default/volatility Official web site]
+
* [https://code.google.com/p/volatility/ Official web site]
* [http://code.google.com/p/volatility/ Code repository]
+
* [http://code.google.com/p/volatility/source/checkout Code repository], direct link to [http://code.google.com/p/volatility/source/browse/ source]
 
* [http://code.google.com/p/volatility/w/list Volatility Documentation]
 
* [http://code.google.com/p/volatility/w/list Volatility Documentation]

Latest revision as of 20:02, 29 January 2014

Volatility
Maintainer: AAron Walters
OS: Cross-platform
Genre: Memory Analysis
License: GPL
Website: https://code.google.com/p/volatility/

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License (GPL v2), for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

The project was originally developed by and is now headed up by AAron Walters of Volatile Systems.

Plugins

See: List of Volatility Plugins

Memory acquisition drivers

In 2012 Michael Cohen contributed both a Linux and a Windows Open Source memory (acquisition) driver to the Volatility project as part of the Technology Preview (TP) version, aka scudette branch. Since the scudette branch of Volatility has moved on as a separate project, the drivers can now be found as part of the rekall project.

See Also

External Links