Volatility Workbench

[David (PassMark)]

We'll include another update in conjunction with the next major release of OSF.

[dima_0007]

hi; David
Volatility 3 2.4.0 is released, can you update the software? Thank you

https://github.com/volatilityfoundat...lity3/releases

For the 2.4.0 release, the major version has jumped a few numbers for compatibility, but this is the next release including the following:

• New plugins
  • linux.mountinfo
  • linux.psaux
  • windows.devicetree
  • windows.joblinks
  • windows.ldrmodules
  • windows.mbrscan
  • windows.mftscan
  • windows.sessions
• Introduced the concept of modules and module requirements
• Unified symbol handling and ISF file caching between OS versions
• Better QEVM support (fixed the QEMU PCI hole)
• Exposed an API for automatic PDB symbol table use
• Improved contributed documentation
• Various bug fixes and changes across the codebase

[David (PassMark)]

According to their web site V3.1 is current. (which now confusingly seems to be called, Volatility 3 v1.0.0)
https://www.volatilityfoundation.org/releases-vol3

But yes, this doesn't match Github, which has Volatility 3 v2.0.0
https://github.com/volatilityfoundat...lity3/releases

Still doesn't seem to be any Windows executable binary either.

We'll have a look at it when we get time.

Update: Volatility Workbench v3.0.1003 with Windows binary was released based on code from July 18, 2022

[dima_0007]

Are you going to update Volatility 3 2.0.0 for Volatility Workbench?
thank you very much for the software

Volatility 3 2.0.0 Latest
released this 16 days ago

Highlights for this release:

New plugins such as:
Windows networking plugins
Windows crashinfo and skeleton_key_check
Linux kmsg plugin
New layers: AVML and LeechCore
QEMU layer performance optimization
Improved access to Windows library symbols
Better offline and remote support
Improved documentation
Improved working with python requirements
Drop support for python 3.5

[David (PassMark)]

We are already using Volatility 3.1.1.0-beta.1. At least that was what is called at the time. But their old numbing doesn't seem to make sense in the context of their new numbering from the last few months. I also note that they haven't been able to get it working on Windows as a binary. "Windows binary versions will be added once a solution has been found to all pyinstaller packages being identified as malware".

But yes, we are a few months behind and it needs to be updated. It is on out to do list.

[dima_0007]

Are you going to update Volatility 3 1.0.1 for Volatility Workbench?
thank you very much for the software