Volatility 3
The Volatility Foundation · Volatility 3 · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
An open-source memory analysis framework that parses RAM images into processes, network state, loaded modules, injected code, registry hives resident in memory, and command history. Volatility 3 is the actively developed line; Volatility 2 is legacy and should not be the basis of new work, though its documentation is still used for plugin comparison.
Who it is for, and when
Volatility is the default tool for answering what was running and what was in memory at the moment of capture — the questions a disk image cannot answer, such as process injection, in-memory-only malware, decrypted keys and passphrases, and network connections with no on-disk trace. Practitioners reach for it in incident response and in any matter where the machine was live when seized. Volatility 3 dropped the version-specific profile system of Volatility 2 in favour of symbol tables, which changes the workflow substantially if you are coming from the older release.
What it does not cover
Volatility parses memory; it will not acquire it, and a bad acquisition is not recoverable in analysis. Nothing in the framework repairs a smeared or torn dump taken from a running system, and it will not tell you about activity that left no trace in RAM at capture time — for the acquisition step you need a separate tool such as Magnet DumpIt or the acquisition side of a commercial suite.
Go to the source
Open at volatility3.readthedocs.io (opens in a new tab)https://volatility3.readthedocs.io/
Details
- Type
- Tool
- Written for
- AdvancedWorking examinerAdvanced, Working examiner
- Publisher
- The Volatility Foundation
- Version verified
- Volatility 3
- Year
- 2026
- Topics
- memory-forensics, incident-response, malware, windows, linux, open-source
- Checked at source
Related entries
Memory acquisition and analysis across Windows, Linux and macOS, written by the people who built Volatility: process and kernel structures, code injection, rootkit detection, registry and event logs recovered from RAM, the GUI subsystem, network state, and case studies.
The Volatility Foundation keeps the Volatility Framework — currently Volatility 3 — free and open source on GitHub, with the accompanying project documentation. Separately it endorses instructor-led memory forensics courses; the Foundation's site does not publish prices for those, and the Malware and Memory Forensics class is a commercial offering run through memoryanalysis.net.
MemProcFS
FreeAn open-source memory forensics tool that mounts a RAM image (or live memory) as a virtual file system, so processes, handles, registry, and network state appear as browsable files and directories rather than plugin output. It ships a Python and C API and a plugin ecosystem.
SIFT Workstation
FreeA free Ubuntu LTS-based virtual machine appliance from SANS that bundles more than a hundred open-source incident response and forensic tools, pre-configured and dependency-resolved. It is still actively updated by Rob Lee and a small team and underpins several SANS DFIR courses.
13Cubed
Partly freeA YouTube channel and companion training site covering Windows, Linux and macOS endpoint forensics, memory analysis and threat hunting. The YouTube videos are free; the on-demand courses on training.13cubed.com are paid.