volatility3

基于Memprocfs和Volatility的可视化内存取证工具

Windows symbol tables for Volatility 3

Project containing several tools/ scripts to recover the OpenSSH session keys used to encrypt/ decrypt SSH traffic.

Volatility3 Linux profiles

Decrypt VMware vTPM-encrypted .vmem/.vmsn/.vmss/.nvram from the VM password, and flatten the .vmem to a Volatility-ready image.

This project is for DFIR that wants to speed up some memory forensic analysis

Volatility, on Docker 🐳

Generate Volatility3 profiles from BTF.

PyDFIRRam is a Python library leveraging Volatility 3 to simplify and enhance memory forensics. It streamlines the research, parsing, and analysis of memory dumps, allowing users to focus on data rather than commands.

Skalle is a handy add-on for Volatility that lets you run it in a graphical user interface. It also adds some cool features!

Linux BPF plugins for Volatility3

Volatility3 plugin to validate Authenticode-signed processes, either with embedded signature or catalog-signed

A suite of Volatility 3 plugins for memory forensics of Docker containers

Volatility 3 plugins to extract a module as complete as possible

Volatility 3 plugin for extracting BitLocker Full Volume Encryption Keys (FVEK)

M3MX Unified memory forensics workbench powered by Volatility manual & automated analysis, MITRE ATT&CK mapping, and an AI agent, all in your browser.

My Linux profiles built for Volatility 2/3

Volatility-CheatSheet

Volatility3 plugin to calculate and compare Windows processes fuzzy hashes

Linux symbols creation tool for Volatility3