Volatility 2.1 (Malware and 64-bits) is released. This is the first release to support all major 64-bit versions of Windows. It also included the ability to convert raw memory images to crash dumps, extract command history and console input/output buffers, and an API for accessing cached registry keys and values from memory. Ten new plugins were added with a specific focus on malware analysis.

AAron Walters posts a challenge to the memory forensics community: detect the “undetectable” by using Volatility to find artifacts in memory for a new Metasploit payload known to be leveraging a technique known as Reflective DLL Injection. Less than 24 hours later, Michael Hale Ligh is the first person to respond to the challenge and proves that Volatility can find hidden DLLs and other injected code blocks.