Skip to content
SPECIFICTION
Get listed

Volatility 3

volatilityfoundation.org

Free plan WindowsmacOSLinuxSelf-hosted
Visit volatilityfoundation.org
Spec score 7.3 #12 of 23 in Computer Forensics Software

What it is

Volatility 3 is a free, open-source framework for extracting digital artifacts from volatile memory (RAM) samples. It gives investigators visibility into a system's runtime state and focuses on memory forensics rather than disk imaging or mobile forensics. It supports memory images from Windows, macOS, and Linux, and offers CSV, JSON, JSONL, pretty, and quick export formats.

Volatility 3 requires Python 3.8.0 or later and is published on PyPI. Windows symbols can be queried, downloaded, generated, and cached when missing; Mac and Linux symbol tables must be produced manually. A 2024 release added support for Amazon S3 and Google Cloud Storage. Documentation is generated from doc strings with Sphinx and available online. Bug reports go to GitHub Issues, while community questions can be taken to Slack. The license permits free use, sharing, and building, but requires public source sharing for additions made available to others. It provides the software as is, without warranty or condition to the extent allowed by law.

Spec sheet

Purpose
Volatility 3 extracts digital artifacts from volatile memory (RAM) samples to provide visibility into a system’s runtime state.Read 30 Sep 2026 · github.com
Intended users
The Foundation says Volatility is used by law enforcement, military, academia, and commercial investigators.Read 30 Sep 2026 · volatilityfoundation.org
Support
The project directs bug reports to GitHub Issues and community support questions to its Slack.Read 30 Sep 2026 · github.com
Cloud storage
The Foundation says a 2024 release added support for Amazon S3 and Google Cloud Storage.Read 30 Sep 2026 · volatilityfoundation.org
Documentation
The framework is documented through doc strings, can be built with Sphinx, and has generated documentation online.Read 30 Sep 2026 · github.com
License conditions
The Volatility Software License allows free use, sharing, and building, and requires publicly sharing source code for additions made available to others.Read 30 Sep 2026 · volatilityfoundation.org
License warranty
The license says the software is provided as is without warranty or condition, to the extent allowed by law.Read 30 Sep 2026 · volatilityfoundation.org
Open source
The Volatility Foundation describes the framework as free and open source, available for download on GitHub.Read 30 Sep 2026 · volatilityfoundation.org
Python requirement
Volatility 3 requires Python 3.8.0 or later and is published on PyPI.Read 30 Sep 2026 · github.com
Release status
The Foundation’s history page lists Volatility 3 version 2.28.2 as released in September 2026.Read 30 Sep 2026 · volatilityfoundation.org
Supported systems
The project provides symbol table packs for Windows, macOS, and Linux; Windows symbols can be queried, downloaded, generated, and cached when missing, while Mac and Linux symbol tables must be produced manually.Read 30 Sep 2026 · github.com
Training
The Foundation offers an endorsed malware and memory forensics training course designed and taught by the framework’s creators.Read 30 Sep 2026 · volatilityfoundation.org

Plans and prices

Volatility 3 Free Free open source software · License requires publicly sharing source code for additions made available to others Read 30 Sep 2026 · volatilityfoundation.org

Every Volatility 3 plan and price →

Strong points and limits

Strong points

  • Free, open-source memory forensics framework
  • Supports Windows, macOS, and Linux memory images
  • Exports CSV, JSON, JSONL, pretty, and quick formats
  • Adds Amazon S3 and Google Cloud Storage support

Limits

  • Requires Python 3.8.0 or later
  • Mac and Linux symbol tables require manual production
  • No mobile forensics or disk imaging
  • License requires public source sharing for distributed additions

Who it suits

It suits investigators in law enforcement, the military, academia, and commercial settings who need to examine memory samples. Users should be prepared to meet its Python requirement and manually produce Mac and Linux symbol tables.

Verdict

Volatility 3 focuses on memory analysis across Windows, macOS, and Linux, with no charge for the software. Its Python requirement, manual Mac and Linux symbol work, and license conditions are important to consider.

Where Specifiction places it

Alternatives to Volatility 3All alternatives →