volatility

Official account of the Volatility Memory Analysis Project and Windows Malware and Memory Forensics Training.

[volatility @volatility]

.@volatility New Release: #volatility3 v2.28.0 - visit https://t.co/KhWIzDVSEG for details and downloads.

#memoryforensics #dfir

[Andrew Case @attrc]

I am excited to announce that I will be speaking at @bsidesnash on May 15th. Be sure to attend to see all the latest @volatility 3 plugins against the most sophisticated and devastating malware from the wild!

[Andrew Case @attrc]

Memory-only malware leaves no trace on the file system & is commonly used by threat actors ranging from criminal organizations to ransomware operators to APTs. In our @volatility 3 training, students gain deep hands on experience analyzing such threats:

https://t.co/kihCRhwaov

[volatility @volatility]

We have announced the winners of the 2025 @volatility
#PluginContest! And the First Place is:

Daniel Baier for XFRM Inspector

Read the full Contest Results in our blog post:
https://t.co/D5lwMbOJV0

Congrats to all winners & thank you to all participants!
#DFIR #memoryforensics

[volatility @volatility]

The 2025 @volatility #PluginContest review is complete! We received 8 submissions from 7 different countries that included 20 plugins!

We will be highlighting each #Contender & the winners will be announced on Friday!

#DFIR #memoryforensics

[volatility @volatility]

The annual @volatility #PluginContest continues to highlight how #memoryforensics researchers are innovating + contributing to #Volatility3!

Special thanks to the core developers & previous winners who helped review this year's submissions!

[volatility @volatility]

We are excited to announce the 2025 @volatility #PluginContest First Place winner is:

Daniel Baier for XRFM Inspector

See the full Contest Results: https://t.co/D5lwMbOJV0

Congrats to all winners & thank you to all participants!
#DFIR #memoryforensics

[volatility @volatility]

The 2025 @volatility #PluginContest review is complete! We received 8 submissions from 7 different countries that included 20 plugins!

We will be highlighting each #Contender & the winners will be announced on Friday!

#DFIR #memoryforensics

[volatility @volatility]

We will announce the winners of the 2025 @volatility #PluginContest winners tomorrow, Friday, Mar 6, so stay tuned!

#DFIR #memoryforensics #Volatility3

[volatility @volatility]

The 2025 @volatility #PluginContest review is complete! We received 8 submissions from 7 different countries that included 20 plugins!

We will be highlighting each #Contender & the winners will be announced on Friday!

#DFIR #memoryforensics

[volatility @volatility]

.@volatility #PluginContest #Contender
Théo Letailleur: Journald Extractor automates extraction of Linux journal files cached in memory, along with analysis via the open-source go-journalctl tool to obtain parsed versions of these files from memory.
#DFIR #memoryforensics

[volatility @volatility]

The 2025 @volatility #PluginContest review is complete! We received 8 submissions from 7 different countries that included 20 plugins!

We will be highlighting each #Contender & the winners will be announced on Friday!

#DFIR #memoryforensics

[volatility @volatility]

.@volatility #PluginContest #Contender
Kyrre Wahl Kongsgård: Arrow & Parquet Renderers allows #Volatility3 plugin output to be written via the Arrow + Parquet renderers, enabling the output to be integrated into tools for modern data analysis workflows.
#DFIR #memoryforensics

[volatility @volatility]

.@volatility #PluginContest #Contender
Diyar Saadi Ali: This submission includes a suite of detection plugins & tools to identify suspicious processes + artifacts within the memory sample of a suspected system using a variety of heuristics & indicators.
#DFIR #memoryforensics

[volatility @volatility]

.@volatility #PluginContest #Contender
Kartik Iyer: APCWatch & MalAPC together provide the capability to identify & analyze APC injection attacks in Windows memory forensics, one of the most sophisticated code injection techniques employed by modern malware
#DFIR #memoryforensics

[volatility @volatility]

.@volatility #PluginContest #Contender
Thomas Clark: The EA App Artifacts, MetaHorizonWorlds & SteamArtifacts plugins help investigators with incidents involving popular gaming platforms by scanning memory for relevant processes and artifacts.
#DFIR #memoryforensics

[volatility @volatility]

.@volatility #PluginContest #Contender
Daniel Baier: XRFM Inspector includes a suite of #Volatility3 plugins that perform the extraction of VPN (IPSEC) related artifacts and cryptographic keys from the XFRM Linux subsystem.
#DFIR #memoryforensics

[volatility @volatility]

.@volatility #PluginContest #Contender
Jan-Hendrik Lang: MemoryInvestigator specializes in Windows memory analysis & integrates #Volatility3 and LLMs, including Retrieval-Augmented Generation (RAG) and an enhanced Tree-of-Table Algorithm
#DFIR #memoryforensics

[volatility @volatility]

.@volatility #PluginContest #Contender
Devarjya Purkayastha: PEScan provides an alternative method for analyzing PE files in a memory sample, assigning a threat score to each memory region that contains a PE file & summarizing high/critical regions.
#DFIR #memoryforensics

[volatility @volatility]

.@volatility New Release: #volatility3 v2.27.0 - visit https://t.co/KhWIzDVkP8 for details and downloads.

#memoryforensics #dfir

[Sylvain Peyrefitte @citronneur]

Kerberos plugin for @volatility allows you to list and extract tickets from memory dump. Another way to track user activity by checking services tickets !

https://t.co/U0pNB9rQvp

[kyrre @cauchyzk]

We’ve now made our @DEATHCon2025 workshop
Building Custom Memory Analysis Tools with the Modern Python Data Ecosystem publicly available.

The workshop shows how to build custom memory forensics tools on top of @volatility output using @marimo_io, @duckdb, and @IbisData.

We start with an introduction to marimo notebooks, DuckDB, and the Ibis dataframe library, then move into incident response workflows where Volatility plugin output is treated as tabular data stored in DuckDB tables and processed and presented interactively in a notebook environment.

From there, we build reusable analysis components, show how marimo’s reactive execution model enables a custom interactive environment for YARA development, demonstrate how to process string data contained in memory dumps, and finally show how to create custom interactive visualizations and widgets.

All notebooks, files, and accompanying videos are now available to everyone.

[volatility @volatility]

And that’s it! The 2025 @volatility #PluginContest is now closed. Stay tuned for winner announcements in the coming weeks! And good luck to all contenders!
#memoryforensics #opensource #dfir

[volatility @volatility]

Today is the last day to submit entries to the #PluginContest! This is your chance to gain industry-wide visibility for your work, contribute to an important open-source project, and compete for cash prizes! More details below!👇