Volatility 2.0 (Beyond XP)

This first major release from the 1.x series added over 40 new plugins (including volshell) and took Volatility beyond Windows XP. It supported 2003 Server, Vista, 2008 Server, and 7. It also introduced a new scanning framework and a pluggable address space system with examples such as EWF and Firewire.

 

Released: August 2011

 

 

Release Highlights

 

  • ​Restructured and depolluted namespace

  • Usage and Development Documentation

  • New Configuration Subsystem

  • New Caching Subsystem

  • New Pluggable address spaces with automated election

  • New Address Spaces (i.e. EWF, Firewire)

  • Updated Object Model and Profile Subsystems (VolatilityMagic)

  • Support for Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7

  • Updated Scanning Framework

  • Volshell integration

  • Over 40 new plugins!

 

Operating System Support

 

  • 32-bit Windows 7 (all service packs)

  • 32-bit Windows Server 2008 (all service packs)

  • 32-bit Windows Vista (all service packs)

  • 32-bit Windows Server 2003 (all service packs)

  • 32-bit Windows XP (SP2 and SP3)

 

Memory Format Support

 

  • Raw/Padded Physical Memory

  • Firewire (IEEE 1394)

  • Expert Witness (EWF)

  • 32-bit Windows Crash Dump

  • 32-bit Windows Hibernation

© 2020 The Volatility Foundation