Skip to content

Volatility Workbench 0.1.2

Pre-release
Pre-release

Choose a tag to compare

View all tags
@NoCoolUserName NoCoolUserName released this 25 Oct 01:14
v0.1.2
5db5b02
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Workbench 0.1.2 adopts MCP 0.1.3 and bundles CryptoMem 0.4.0's experimental legacy Intel64 macOS adapter alongside Windows and Linux. All three commands use the existing ten MCP tools, manual selection, offline execution and XP-independent discovery. No UI redesign or separate detector is added.

Use the existing legacy Mac symbol pack only when its Darwin kernel exactly matches the captured image. Nested submaps (including ordinary shared-region maps), Intel32/Apple-silicon Mac captures and modern macOS are unsupported. Real-memory Mac and Linux validation remain outstanding. The application running on Apple silicon is distinct from support for Apple-silicon captures.

The native Mac app remains an ad-hoc signed prerelease, not Apple-notarized. The additional 10,255-table Linux collection remains in the configured external symbol store, outside the app and Git. Exact kernel matching is always required.

Assets 5
Loading