Memory forensics framework
Framework for extracting digital artefacts from memory images (RAM dumps) of Windows, Linux and macOS systems, rewritten in Python 3.
Volatility analyses captured memory to recover processes, network connections, loaded modules, registry hives, command history and signs of code injection. Volatility 3 is a complete rewrite of the classic framework with symbol tables instead of profiles and a cleaner plugin interface.
It is a standard tool for incident responders and malware analysts. Its licence is the Volatility Software License, a custom licence, so ThreatWire labels it source-available.
Volatility Software License 1.0 · Source-available
Custom licence from the Volatility Foundation, not OSI-approved; GitHub reports it as unrecognised (NOASSERTION).
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: NOASSERTION. Source-available means the code is public but the licence is not approved by the Open Source Initiative.
No published advisory found for Volatility 3 in GitHub repository advisories. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories · checked 2026-10-20.
Digital forensics platform built on The Sleuth Kit
Graphical digital forensics platform that analyses disk images and devices with The Sleuth Kit, with modules for timelines, keyword search and artefacts.
Super timeline creation for forensic analysis
Python engine that extracts timestamps from hundreds of file and log formats on a disk image and merges them into one forensic super timeline.
UNIX-like reverse engineering framework
Command-line reverse engineering framework with a disassembler, debugger, hex editor and scripting for many architectures and file formats.
Pattern matching for malware research
Tool and rule language from VirusTotal to identify and classify malware samples using textual and binary patterns plus conditions.
Endpoint visibility and digital forensics at scale
DFIR tool that collects forensic artefacts and hunts across fleets of endpoints with its query language VQL, from a single server binary.
Software reverse engineering framework from the NSA
Reverse engineering suite released by the NSA with disassembly, decompilation, graphing and scripting for many processor architectures.
