Volatility 3 is a memory forensics framework. Feed it a copy of a computer’s RAM and it recovers the processes that were running, the network connections that were open and the traces a piece of malware left behind. It is developed by the Volatility Foundation, a US nonprofit organization. The foundation’s website says the very first version of Volatility was shown publicly in 2007, at the Black Hat DC conference.
Today’s branch is a ground-up rewrite in Python 3, first released in 2019. It replaces Volatility 2, whose repository was archived on May 16, 2025. The code ships under the Volatility Software License, a license written by the foundation that allows free use but requires you to publish any changes you make available to others.
What Volatility 3 is for
When a machine has been compromised, some of the evidence only ever exists in memory: code injected into a legitimate process, a live connection to a remote server, a command typed a few minutes earlier. Volatility 3 works on a memory image captured beforehand and rebuilds the state of the system at the moment of capture, independently of the machine under investigation and of its operating system.
Each kind of analysis is handled by a plugin run from the command line. On Windows, plugins list processes and their parent relationships, loaded libraries, command lines, network connections and suspicious memory regions that often point to injected code. Linux has its own set, which can for instance recover bash history or list kernel modules. A plugin that scans memory with YARA rules, a tool also featured in our software library, lets analysts hunt for a specific signature across the whole image.
The biggest change from Volatility 2 lies in how target systems are described. The old version required a profile matching the original system exactly. Volatility 3 relies on symbol tables instead. Missing Windows tables are downloaded and cached automatically, whereas Linux and macOS tables usually have to be generated with the dwarf2json utility from the kernel in question. Formats named in the documentation include Windows crash dumps, LiME and AVML captures taken on Linux, and VMware, QEMU and Xen virtual machine files.
Where Autopsy, which we also cover, examines hard drives and phones, Volatility 3 focuses on memory. The two fit together well, and Autopsy even offers an experimental module that calls Volatility.
Who is it for?
Volatility 3 is built for incident responders, digital forensics investigators, malware researchers and students in specialized security courses. Developers can also use it as a base for their own plugins, something the foundation has encouraged since 2013 through an annual contest with cash prizes.
You do need to be comfortable at the command line and have some understanding of operating system internals to make sense of the output. macOS support is winding down: a warning added in version 2.28.2 states that macOS analysis is no longer actively maintained and that existing plugins may not receive future updates. There is no official graphical interface either, which can put off people used to Autopsy.
Download Volatility 3 safely
Source code and releases live in the volatilityfoundation/volatility3 repository on GitHub. The latest release, 2.28.2 from September 17, 2026, installs with pip from the volatility3 package that the project maintainers publish on PyPI, and needs Python 3.8 or later. Despite the name, Volatility 3 uses 2.x version numbers, which regularly confuses newcomers. Since version 2.27.0 the releases page has also offered a zip of Windows executables weighing about 44 MB.
Nothing is paid. The foundation is funded by sponsors, Volexity among them. Because Volatility usually runs on analysis workstations that hold sensitive data, stay away from executables reposted on forums or file-sharing sites and stick to GitHub and PyPI.
Frequently asked questions
Is Volatility 3 free?
Yes. It is free for any use and the source code is public. The Volatility Software License only asks you to publish, under the same license, any changes or additions you make available to other people, including over the internet.
Should I still use Volatility 2?
No. Its repository has been archived since May 16, 2025, and the Volatility 3 release notes describe it as no longer supported. Version 2.26.0, released that same day, was specifically aimed at feature parity with the old branch.
Can Volatility 3 capture a computer’s memory?
No, it only analyzes images that already exist. Acquisition is the job of dedicated tools such as LiME or AVML on Linux, whose formats Volatility can read. With virtual machines, the state files saved by the hypervisor are another starting point.
