Tool Open source
vol-rs is a Rust port of the Volatility 3 memory-forensics framework. It reads the same memory-image formats, runs the same plugins and options, and is designed to produce byte-for-byte equivalent output while running faster than the Python implementation.
The project ports Volatility 3's 197 plugins and command-line interface, including plugin listing, CSV rendering, filtering, symbol handling, and configuration options. Its built-in components include symbol decompression, RC4, DES, AES, YARA matching, x86 disassembly, PNG writing, and tar-archive creation, avoiding the Python version's external dependencies for those functions. Symbol packs can be loaded from configured directories, and Windows symbols can be fetched from Microsoft's symbol server and cached locally.
The repository reports identical plugin help for all 197 plugins, matching output across tested Windows and Linux captures, and substantially shorter benchmark runtimes on those captures. Testing remains incomplete for real macOS images, 32-bit images, several image formats, and additional kernel versions. vol-rs is distributed under the Volatility Software License 1.0 as an addition to Volatility 3 and is not affiliated with or endorsed by the Volatility Foundation.
1 use taken from transcripts — each links to the moment in the video.
A Rust rewrite of Volatility 3 with all 197 plugins and matching output. It is presented as a faster memory-forensics tool with symbol decompression, YARA matching, and x86 disassembly.
1 in the library.