- Home
- Computer Forensics Software
- Volatility 3
Volatility 3
What it is
Volatility 3 is a free, open-source framework for extracting digital artifacts from volatile memory samples. It provides visibility into a system’s runtime state for memory forensics, rather than disk imaging or mobile forensics. The project supports memory images from Windows, macOS, and Linux and requires Python 3.8.0 or later. Windows symbols can be queried, downloaded, generated, and cached when missing; Mac and Linux symbol tables must be produced manually. A 2024 release added Amazon S3 and Google Cloud Storage support. Documentation is generated from doc strings with Sphinx and published online. The Volatility Software License permits free use, sharing, and building, but additions made available to others require public source sharing. The license provides the software as is without warranty or condition to the extent allowed by law. Bug reports go to GitHub Issues, while community questions are directed to Slack. The Foundation lists law enforcement, military, academia, and commercial investigators among its users.
For and against
For
- Free and open source
- Supports Windows, macOS, and Linux memory images
- Windows symbols can be cached automatically
- Amazon S3 and Google Cloud Storage support
- Online Sphinx documentation
Against
- Requires Python 3.8.0 or later
- Mac and Linux symbols require manual production
- Not intended for disk imaging
- License requires source sharing for distributed additions
The verdict
Volatility 3 is a focused framework for examining RAM captures and extracting runtime artifacts. Its free license and broad operating-system support suit forensic workflows, with symbol handling differing by platform.
Who it suits
It suits investigators and analysts performing memory forensics on Windows, macOS, or Linux images. The listed audiences include law enforcement, military, academic, and commercial investigation teams.
Plans and prices
Volatility 3
Free open source software · License requires publicly sharing source code for additions made available to others
Read 30 Sep 2026 · volatilityfoundation.org
On the record
- Cloud storage
- The Foundation says a 2024 release added support for Amazon S3 and Google Cloud Storage.volatilityfoundation.org · read 30 Sep 2026
- Documentation
- The framework is documented through doc strings, can be built with Sphinx, and has generated documentation online.github.com · read 30 Sep 2026
- Intended users
- The Foundation says Volatility is used by law enforcement, military, academia, and commercial investigators.volatilityfoundation.org · read 30 Sep 2026
- License conditions
- The Volatility Software License allows free use, sharing, and building, and requires publicly sharing source code for additions made available to others.volatilityfoundation.org · read 30 Sep 2026
- License warranty
- The license says the software is provided as is without warranty or condition, to the extent allowed by law.volatilityfoundation.org · read 30 Sep 2026
- Open source
- The Volatility Foundation describes the framework as free and open source, available for download on GitHub.volatilityfoundation.org · read 30 Sep 2026
- Purpose
- Volatility 3 extracts digital artifacts from volatile memory (RAM) samples to provide visibility into a system’s runtime state.github.com · read 30 Sep 2026
- Python requirement
- Volatility 3 requires Python 3.8.0 or later and is published on PyPI.github.com · read 30 Sep 2026
- Release status
- The Foundation’s history page lists Volatility 3 version 2.28.2 as released in September 2026.volatilityfoundation.org · read 30 Sep 2026
- Support
- The project directs bug reports to GitHub Issues and community support questions to its Slack.github.com · read 30 Sep 2026
- Supported systems
- The project provides symbol table packs for Windows, macOS, and Linux; Windows symbols can be queried, downloaded, generated, and cached when missing, while Mac and Linux symbol tables must be produced manually.github.com · read 30 Sep 2026
- Training
- The Foundation offers an endorsed malware and memory forensics training course designed and taught by the framework’s creators.volatilityfoundation.org · read 30 Sep 2026
