v1.0.0

First release of vol-rs, a port of the Volatility 3 memory forensics framework from Python to Rust. It reads the same images, takes the same plugins and options, and prints the same output, byte for byte, a good deal faster.

197 plugins: 105 Windows, 60 Linux, 23 macOS and 9 that describe the tool or work on any image. Nothing optional is needed at build or run time.

Speed

Sweep	vol-rs	Volatility 3	Faster
Windows, 99 plugins	273 s	5723 s	x21
Linux, 56 plugins	68 s	3130 s	x46

The widest single gap is x599. See BENCHMARKS.md for every plugin. These numbers come from one machine and one pair of captures, so your own will differ.

How closely the output matches

Check	Result
Windows plugins with no arguments	99 of 100 identical
Linux plugins with no arguments	56 of 57 identical
Runs that take arguments	43 of 43 identical
Files written by extracting plugins	1,747 compared, every file both tools wrote is equal
Plugin help pages	197 of 197 identical

The two plugins missing from those counts are the ones the Python version cannot finish on the test machine. The few things that cannot match are listed under Known differences in the README.

The macOS plugins have not been run against a real Mac capture, since none was available. Every type, member and symbol they read was checked against the 129 published Darwin symbol files covering 10.10 to 10.15.

Downloads

Pick the archive for your platform below. Each ships the binare and the benchmarks, and a .sha256 next to it.

Published under the Volatility Software License 1.0, the same port of. Not affiliated with or endorsed by the VolatilityFoundation.