volatility3

library2.28.0pypypi✓ verified 85d ago

Volatility 3 is the next-generation memory forensics framework for analyzing memory dumps (RAM captures). It extracts digital artifacts from volatile memory (RAM) samples on Windows, Linux, and macOS. Current version 2.28.0 (released 2025-05-02) is stable and actively maintained, with about 2-3 releases per year.

security

pip install volatility3

INSTALL

IMPORT

SIG · VOLATILITY3

volatility3

securitypythonv2.28.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

volatility3

✓ import volatility3

✗ import volatility

'volatility' is the old Volatility 2.x package. Use 'volatility3' for this version.

VolatilityFramework

✓ from volatility3.framework import contexts

✗ from volatility import framework

The main namespace changed; Volatility 3 uses 'volatility3.framework'.

Basic usage: import volatility3.cli and use sys.argv to pass command-line arguments as in the standard CLI.

import os import volatility3.cli as cli # Run a basic memory dump analysis (example using a Windows memory image) if __name__ == '__main__': # Replace with your image path image_path = '/path/to/memory.dmp' # Run the windows.pslist plugin sys.argv = ['vol', '-f', image_path, 'windows.pslist'] cli.main()

Debug

Known issues

breakingVolatility 3 is NOT a drop-in replacement for Volatility 2. Plugin names, command-line flags, and the output format have changed significantly. Do NOT expect Volatility 2 profiles to work.

fix

Refer to the official Volatility 3 documentation for new plugin names (e.g., 'windows.pslist' instead of 'pslist') and use JSON output with --output-format=json if needed.

affects: 2.0.0 and above

gotchaThe simple 'vol' script/entry point may not be installed correctly when using pip. Running 'vol' from command line may fail. Use 'python -m volatility3' instead.

fix

Use 'python -m volatility3' or 'python3 -m volatility3' to invoke the framework.

affects: 2.0.0 to 2.28.0

deprecatedThe 'volatility3.framework.plugins.linux' module has been deprecated in favor of direct imports from 'volatility3.plugins.linux'.

fix

Use 'from volatility3.plugins.linux import pslist' instead of 'from volatility3.framework.plugins.linux import pslist'.

affects: > 2.5.0

gotchaWhen using 'volatility3.plugins.windows.pslist' directly, the plugin expects a 'context' object and a configuration dictionary. Simply calling PsList.list_offsets() without proper context will raise AttributeError.

fix

Use the CLI or the 'vol' entry point to avoid manual context setup. If programmatic usage is required, follow the official developer guide.

affects: All versions

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'volatility'

Installed Volatility 3 but tried to import 'volatility' (the old Volatility 2 package).

fix

Install volatility3: 'pip install volatility3' and import 'volatility3' (or run 'python -m volatility3').

volatility3.exceptions.vol_exceptions.VolatilityError: The config file was not loaded. Use --plugins to specify a plugins directory or use the bundled plugins.

The framework cannot find the default plugin directory (e.g., when running from a script without the -f flag or improper config).

fix

Ensure you supply a valid memory image with '-f <image>' and that the image path exists. For custom plugins, use '--plugins-dir'.

AttributeError: module 'volatility3' has no attribute 'framework'

The import path is incorrect. 'volatility3.framework' must be explicitly imported.

fix

Use 'from volatility3.framework import contexts' or run the CLI entry point.

Upgrade

Version history

2.28.0latest on PyPI · released Apr 30, 2026

Audit

Dependencies

pefilerequiredRequired for Windows PE file parsing (e.g., windows.registry, windows.psscan)

yara-pythonoptionalRequired for YARA scanning (e.g., windows.malfind, linux.malfind)

capstoneoptionalRequired for disassembly (e.g., windows.callouts, linux.check_tty)

jsonschemarequiredRequired for schema validation of plugin output

Agent activity

42 hits · last 30 days

node

Resources

No resource links recorded.