FAQ

Frequently Asked Questions

• General

  • What is the latest stable version of Volatility
  • What is the latest development version of Volatility
  • What's new in 2.4
  • What operating systems does Volatility support
  • What about reading crash dumps and hibernation files
  • Can Volatility acquire physical memory
  • What's the largest memory dump Volatility can read
  • Are there any public memory samples available that I can use for testing

• Installation

  • What are the dependencies for running Volatility

• Usage

  • How do I run Volatility
  • How can I run external plugins with the standalone executable
  • Where can I find additional documentation on Volatility

• Troubleshooting

  • I'm getting an error: [..] ( ImportError : No module named Crypto.Hash)
  • Volatility thinks my image is invalid
  • No address space mapping, No valid DTB found
  • Scanning commands report false positives
  • How can I report a bug or feature request

• Contact

  • Who wrote/is writing Volatility
  • How can I contribute to Volatility

What is the latest stable version of Volatility

The latest stable version is 2.4. You can grab the source code, Python installer, or Windows standalone executable from the downloads page

What is the latest development version of Volatility

The latest development version is 2.4 which you can get by checking out the main branch using git ($ git clone git@github.com:volatilityfoundation/volatility.git).

What's new in 2.4

What operating systems does Volatility support

What about reading crash dumps and hibernation files

Can Volatility acquire physical memory

Are there any public memory samples available that I can use for testing