Oxygen Forensic Detective vs Volatility 3
Oxygen Forensic Detective
oxygenforensics.comVolatility 3
volatilityfoundation.orgSide by side
| Figure | Oxygen Forensic Detective | Volatility 3 |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · Computer Forensics Software | 7.3 (#11) | 7.3 (#12) |
| Spec score · Digital Forensics Software | 7.3 (#21) | 7.3 (#22) |
| Intended users | Oxygen Forensics describes its customers as law enforcement, government, military, and enterprise investigative teams. | The Foundation says Volatility is used by law enforcement, military, academia, and commercial investigators. |
| Purpose | Oxygen Forensic® Detective extracts, decodes, and analyzes digital evidence from multiple sources for forensic investigations. | Volatility 3 extracts digital artifacts from volatile memory (RAM) samples to provide visibility into a system’s runtime state. |
| Support | The getting-started guide says customers can use their customer area to download software and supporting files, request the latest keycode, or contact support. | The project directs bug reports to GitHub Issues and community support questions to its Slack. |
Plans
Oxygen Forensic Detective
- Oxygen Forensic® DetectivePriced on request
In their own words
Oxygen Forensic Detective
Oxygen Forensic Detective has no write-up on Specifiction yet; its figures are above.
Volatility 3
Volatility 3 is a free, open-source framework for extracting digital artifacts from volatile memory (RAM) samples. It gives investigators visibility into a system's runtime state and focuses on memory forensics rather than disk imaging or mobile forensics. It supports memory images from Windows, macOS, and Linux, and offers CSV, JSON, JSONL, pretty, and quick export formats.
Volatility 3 requires Python 3.8.0 or later and is published on PyPI. Windows symbols can be queried, downloaded, generated, and cached when missing; Mac and Linux symbol tables must be produced manually. A 2024 release added support for Amazon S3 and Google Cloud Storage. Documentation is generated from doc strings with Sphinx and available online. Bug reports go to GitHub Issues, while community questions can be taken to Slack. The license permits free use, sharing, and building, but requires public source sharing for additions made available to others. It provides the software as is, without warranty or condition to the extent allowed by law.