Download Latest Version
volatility_2.6_lin64_standalone.zip (14.7 MB)
Get an email when there's a new version of Volatility
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| hashes.txt | 2024-04-09 | 671 Bytes | |
| volatility-2.6.zip | 2024-04-09 | 4.2 MB | |
| volatility_2.6_win64_standalone.zip | 2024-04-09 | 15.6 MB | |
| volatility_2.6_mac64_standalone.zip | 2024-04-09 | 19.9 MB | |
| volatility_2.6_lin64_standalone.zip | 2024-04-09 | 14.7 MB | |
| README.md | 2018-12-18 | 953 Bytes | |
| Volatility 2.6_ December 2016 source code.tar.gz | 2018-12-18 | 5.2 MB | |
| Volatility 2.6_ December 2016 source code.zip | 2018-12-18 | 5.6 MB | |
| Totals: 8 Items | 65.2 MB | 5 | |
-
Enhanced support for Windows 10 (including 14393.447)
-
Added new profiles for recently patched Windows 7, Windows 8, and Server 2012
-
Optimized page table enumeration and scanning algorithms, especially on 64-bit Windows 10
-
Added support for carving Internet Explorer 10 history records
-
Added support for memory dumps from the most recent VirtualBox version
-
Updated the svcscan plugin to show FailureCommand (the command that runs when a service fails to start multiple times)
-
Add APIs to paged address spaces (x86 and x64) to allow easy lookups of PTE flags (i.e. writeable, no-exec, supervisor, copy-on-write)
-
Add support for tagging Mac memory ranges as heaps, stacks, etc.
-
Add plugins for checking Mac file operation pointers, C++ classes in the kernel, IOKit interest handlers, timers set by kernel drivers, and enumeration of processes that filter file system events
-
Add support for KASLR Linux kernels