awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
volatilityfoundation avatar

volatilityfoundation/volatility3

0
View on GitHub↗
volatilityfoundation.org↗

Volatility3

Volatility3 is a memory forensics framework and analysis tool used to parse volatile memory dumps. It extracts digital artifacts and reconstructs the runtime state of a system to recover process information, network artifacts, and other forensic evidence.

The system functions as a plugin-based forensic engine and an operating system symbol resolver. It maps raw memory addresses to known system structures using symbol tables and translation layers, and provides an extensible architecture for creating custom scanners and renderers.

The framework includes a command-line memory explorer for real-time data discovery and a programmable interface for automating the generation of memory reports. It handles digital artifact extraction and system symbol resolution through a layer-based address translation process.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI

Features

  • Digital Forensics - Extracts digital evidence and runtime system state from volatile memory to investigate security incidents.
  • Symbol Table Resolution - Resolves raw memory offsets into human-readable function and structure names using symbol tables.
  • Virtual Address Translators - Simulates the OS memory management unit to map raw physical addresses to virtual addresses.
  • Kernel Symbol Resolution - Resolves raw memory addresses into human-readable function and variable names using kernel symbol tables.
  • Memory Address Translation Layers - Implements layer-based address translation to map raw physical memory addresses to virtual addresses for system state interpretation.
  • Volatile Memory Ingestion - Parses raw memory samples to recover process information, network artifacts, and other forensic evidence.
  • Memory Forensics - Provides a comprehensive framework for analyzing volatile memory dumps to reconstruct runtime system states.
  • Forensic Artifact Extraction - Extracts process information and network artifacts from volatile memory samples for forensic analysis.
  • Volatile Memory Investigation - Provides a command-line interface to explore memory objects and run scripts for real-time data discovery.
  • Extensible Plugin Architectures - Provides an extensible architecture allowing developers to inject custom logic for forensic scanning and rendering.
  • Forensic Engines - Provides an extensible architecture for creating custom scanners and renderers for specialized memory investigation.
  • Symbol-To-Address Mapping - Maps raw memory addresses to known system functions and structures using symbol tables and translation layers.
  • Plugin-Based Architectures - Employs a modular architecture where independent plugins define specific memory scanning and extraction logic.
  • State and Context Management - Implements a global analysis state to maintain consistent configuration and context across multiple forensic plugins.
  • Memory Analysis APIs - Offers programmatic interfaces for managing analysis contexts and plugins to automate memory report generation.
  • Analysis Automation - Programmatically manages analysis contexts and plugins to generate automated reports from system memory dumps.
  • Custom Plugin Development - Allows the creation of specialized scanners and renderers through a programmable interface for custom analysis tasks.
  • Intermediate Representations - Provides a standardized internal representation for OS symbols to decouple source formats from analysis logic.
  • Runtime Memory Explorers - Ships an interactive shell for accessing memory objects and running analysis scripts for real-time exploration.
  • Interactive Shells - Provides an interactive command-line shell for real-time exploration of memory objects and execution of scripts.
  • Digital Forensics - Advanced framework for memory forensics and analysis.
  • Memory Analysis Tools - Modern successor to the standard memory forensics framework.
4,192 stars·663 forks·Python·28 views

Star history

Star history chart for volatilityfoundation/volatility3Star history chart for volatilityfoundation/volatility3

How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

Frequently asked questions

What does volatilityfoundation/volatility3 do?

Volatility3 is a memory forensics framework and analysis tool used to parse volatile memory dumps. It extracts digital artifacts and reconstructs the runtime state of a system to recover process information, network artifacts, and other forensic evidence.

What are the main features of volatilityfoundation/volatility3?

The main features of volatilityfoundation/volatility3 are: Digital Forensics, Symbol Table Resolution, Virtual Address Translators, Kernel Symbol Resolution, Memory Address Translation Layers, Volatile Memory Ingestion, Memory Forensics, Forensic Artifact Extraction.

Which projects share features with volatilityfoundation/volatility3?

Projects with overlapping indexed features include: ufrisk/memprocfs — MemProcFS is a volatile memory analysis tool and cross-platform memory acquisition system. It functions as a memory… volatilityfoundation/volatility — Volatility is a memory forensics framework and digital forensics tool designed to extract and analyze evidence from… jaykali/maskphish — Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network… velocidex/velociraptor — Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and… th-ch/youtube-music — This project is a desktop client for YouTube Music, serving as a cross-platform wrapper that encapsulates the… dthree/vorpal — Vorpal is a Node.js interactive CLI framework and terminal user interface library used to build extensible…

Projects sharing features with Volatility3

These projects share indexed features with Volatility3. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
  • ufrisk/memprocfsufrisk avatar

    ufrisk/MemProcFS

    4,202View on GitHub↗

    MemProcFS is a volatile memory analysis tool and cross-platform memory acquisition system. It functions as a memory forensic virtual file system, mapping physical memory and kernel objects into a virtual directory structure that allows users to analyze system artifacts using standard file system tools. The project distinguishes itself by providing a virtual file system for memory forensics, enabling the browsing and querying of physical memory as read-only files and folders. It also incorporates a Yara-based memory scanner to identify malware signatures and injected code within physical memor

    C
    View on GitHub↗4,202
  • volatilityfoundation/volatilityvolatilityfoundation avatar

    volatilityfoundation/volatility

    7,971View on GitHub↗

    Volatility is a memory forensics framework and digital forensics tool designed to extract and analyze evidence from volatile computer memory dumps. It functions as a memory dump parser and analysis platform used to identify running processes, network connections, and loaded modules from a system RAM capture. The framework enables the reconstruction of system state to uncover malicious activity, such as rootkits and injected code, during malware incident response and threat hunting. It provides capabilities for digital forensic investigations to detect unauthorized access and indicators of com

    Pythonmalwarememorypython
    View on GitHub↗7,971
  • jaykali/maskphishjaykali avatar

    jaykali/maskphish

    3,020View on GitHub↗

    Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe

    Shellhackhackinghacking-tool
    View on GitHub↗3,020
  • velocidex/velociraptorVelocidex avatar

    Velocidex/velociraptor

    3,769View on GitHub↗

    Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o

    Godigital-forensicsendpoint-discoveryendpoint-protection
    View on GitHub↗3,769
Compare all 30 related projects→