First release of vol-rs, a port of the Volatility 3 memory forensics framework from Python to Rust. It reads the same images, takes the same plugins and options, and prints the same output, byte for byte, a good deal faster.
197 plugins: 105 Windows, 60 Linux, 23 macOS and 9 that describe the tool or work on any image. Nothing optional is needed at build or run time.
Speed
| Sweep | vol-rs | Volatility 3 | Faster |
|---|---|---|---|
| Windows, 99 plugins | 273 s | 5723 s | x21 |
| Linux, 56 plugins | 68 s | 3130 s | x46 |
The widest single gap is x599. See BENCHMARKS.md for every plugin. These numbers come from one machine and one pair of captures, so your own will differ.
How closely the output matches
| Check | Result |
|---|---|
| Windows plugins with no arguments | 99 of 100 identical |
| Linux plugins with no arguments | 56 of 57 identical |
| Runs that take arguments | 43 of 43 identical |
| Files written by extracting plugins | 1,747 compared, every file both tools wrote is equal |
| Plugin help pages | 197 of 197 identical |
The two plugins missing from those counts are the ones the Python version cannot finish on the test machine. The few things that cannot match are listed under Known differences in the README.
The macOS plugins have not been run against a real Mac capture, since none was available. Every type, member and symbol they read was checked against the 129 published Darwin symbol files covering 10.10 to 10.15.
Downloads
Pick the archive for your platform below. Each ships the binare and the benchmarks, and a .sha256 next to it.
Published under the Volatility Software License 1.0, the same port of. Not affiliated with or endorsed by the VolatilityFoundation.