Volatility (software)

Volatility supports investigations of the following memory images: Windows: • 32-bit Windows XP (Service Pack 2 and 3) • 32-bit Windows 2003 Server (Service Pack 0, 1, 2) • 32-bit Windows Vista (Service Pack 0, 1, 2) • 32-bit Windows 2008 Server (Service Pack 1, 2) • 32-bit Windows 7 (Service Pack 0, 1) • 32-bit Windows 8, 8.1, and 8.1 Update 1 • 32-bit Windows 10 (initial support) • 64-bit Windows XP (Service Pack 1 and 2) • 64-bit Windows 2003 Server (Service Pack 1 and 2) • 64-bit Windows Vista (Service Pack 0, 1, 2) • 64-bit Windows 2008 Server (Service Pack 1 and 2) • 64-bit Windows 2008 R2 Server (Service Pack 0 and 1) • 64-bit Windows 7 (Service Pack 0 and 1) • 64-bit Windows 8, 8.1, and 8.1 Update 1 • 64-bit Windows Server 2012 and 2012 R2 • 64-bit Windows 10 (including at least 10.0.14393) • 64-bit Windows Server 2016 (including at least 10.0.14393.0) Mac OSX: • 32-bit 10.5.x Leopard (the only 64-bit 10.5 is Server, which isn't supported) • 32-bit 10.6.x Snow Leopard • 32-bit 10.7.x Lion • 64-bit 10.6.x Snow Leopard • 64-bit 10.7.x Lion • 64-bit 10.8.x Mountain Lion • 64-bit 10.9.x Mavericks • 64-bit 10.10.x Yosemite • 64-bit 10.11.x El Capitan • 64-bit 10.12.x Sierra • 64-bit 10.13.x High Sierra • 64-bit 10.14.x Mojave • 64-bit 10.15.x Catalina Linux: • 32-bit Linux kernels 2.6.11 to 5.5 • 64-bit Linux kernels 2.6.11 to 5.5 • OpenSuSE, Ubuntu, Debian, CentOS, Fedora, Mandriva, etc. ==Memory format support==

Volatility supports a variety of sample file formats and the ability to convert between these formats: • Raw/Padded Physical Memory • Firewire (IEEE 1394) • Expert Witness (EWF) • 32- and 64-bit Windows Crash Dump • 32- and 64-bit Windows Hibernation (from Windows 7 or earlier) • 32- and 64-bit Mach-O files • Virtualbox Core Dumps • VMware Saved State (.vmss) and Snapshot (.vmsn) • HPAK Format (FastDump) • QEMU memory dumps • LiME format ==References==