Volatility 3 Documentation

Volatility 3 uses a two-step process to extract structured data from memory:

1. Templates (Template): Define the structure of an object (size, member offsets, and field meanings) without containing actual data.
2. Objects (Object): Constructed by applying a Template to a memory layer at a specific offset. Once an Object is created, the data is read from the layer and cached.

Note: Unlike Volatility 2, Volatility 3 constructs actual Python integers and floats rather than proxy objects. If the underlying memory data changes, objects must be manually reconstructed.

Volatility 3 uses JSON files (or compressed versions like .json.gz or .json.xz) to store symbol data. It can also process ZIP files containing symbol files.

Key Locations:

• Default Directory: volatility3/symbols (this directory is configurable within the framework).
• Cache Directory: Volatility caches symbol mappings in ~/.cache/volatility3 or ${XDG_CACHE_HOME}/volatility3 if the environment variable is set. The cache directory cannot be manually altered.

Volatility uses an 'automagic' process to update a cache mapping identifiers to filenames. If many new symbol files are detected, the initial scan may take time, but it can be safely interrupted and restarted.

To run a plugin, you can either manually instantiate it or use the high-level plugins.construct_plugin helper.

Manual Workflow:

1. Check if requirements are met using plugin.unsatisfied(context, plugin_config_path). An empty list means all requirements are satisfied.
2. Instantiate the plugin: constructed = plugin(context, plugin_config_path, progress_callback=...).
3. (Optional) Set a file handler using constructed.set_open_method(file_handler) if the plugin produces files. The handler must implement FileHandlerInterface.
4. Execute: treegrid = constructed.run().

High-level Workflow:

Use plugins.construct_plugin to handle automagics, instantiation, and configuration in one step.

constructed = plugins.construct_plugin(ctx, automagics, plugin, base_config_path, progress_callback, file_consumer)

Volshell is an interactive CLI utility for direct introspection of memory images. You can start it by specifying a memory image file. To improve symbol loading and functionality, you can explicitly specify the operating system using flags:

• -w: Windows
• -m: macOS
• -l: Linux

If no OS is specified, Volshell uses 'automagic' to attempt to identify the operating system. Note that the operating system mode cannot be easily changed once the session has started.

$ volshell.py -f <path-to-memory-image> [-w|-m|-l]

Volatility 3 provides a variety of plugins for Linux memory forensics. Beyond the basic plugins covered in the tutorial, the framework supports analysis of:

• Kernel modules
• Page cache analysis
• Tracing frameworks
• Malware detection

Users can extend the framework by contributing new plugins or enhancements to address specific analysis use cases or gaps in functionality.

To install the stable version of Volatility 3, use pip to install the package from the PyPI registry. Requires Python 3.8.0 or later.

pip install volatility3

Volatility is used to analyze memory images from Windows, Linux, and macOS operating systems. To run a plugin, use the following command structure:

volatility [global_options] <plugin> [plugin_options]

Note on Plugin Selection: You can use any substring that uniquely matches a plugin name. For example, hivescan will match windows.registry.hivescan.HiveScan. However, avoid ambiguous names like pslist if they could match multiple operating systems (e.g., windows.pslist vs linux.pslist).

To see the available options for a specific plugin, run:

volatility <plugin> --help

Automagics help automate the complex process of stacking layers (compression, file formats, architectures) and determining OS-specific information.

1. List available automagics: Use automagic.available(ctx).
2. Select appropriate automagics: Use automagic.choose_automagic(available_automagics, plugin) to filter automagics relevant to the plugin's target operating system.
3. Run automagics: Use automagic.run(...) to apply the configuration. You can provide a progress_callback (a callable taking a percentage and a description string) to track progress.

Plugins should use the open_method abstraction to create files, allowing the user interface to handle the actual file delivery.

1. Set the method on the plugin using plugin.set_open_method.
2. Access the method via plugin.open(preferred_filename), which returns a FileHandlerInterface (acting like an IO[bytes] object).
3. Use the with statement to ensure the file is automatically closed and committed for the UI. Failure to close the file may prevent the UI from processing it correctly.

with self.open(preferred_filename) as file_handle:
    file_handle.write(data)

To process the output of another plugin, you must first generate suitable automagics for the context and then instantiate the target plugin using volatility3.framework.plugins.construct_plugin.

Note: Automagics must be re-run for each plugin to ensure the context's configuration is correctly populated based on that specific plugin's requirements.

automagics = automagic.choose_automagic(automagic.available(self._context), plugin_class)
plugin = plugins.construct_plugin(self.context, automagics, plugin_class, self.config_path,
                                self._progress_callback, self.open)

For complex tasks, you can run Python snippets within the Volshell context. This allows you to use built-in functions like cc (to create constructs like layers or symbol tables) and access self and context directly.

• Execution: Use the run_script (or rs) command to run a script file, or provide a file via the --script command-line flag when starting Volshell.

# Example snippet: creating a new layer and reading bytes
import volatility3.framework.layers.mynewlayer as mynewlayer

layer = cc(mynewlayer.MyNewLayer, on_top_of = 'primary', other_parameter = 'important')
with open('output.dmp', 'wb') as fp:
    for i in range(0, 0x4000000, 0x1000):
        data = layer.read(i, 0x1000, pad = True)
        fp.write(data)