The Volatility Framework 1.1.1 is first publicly released, having evolved from FATKit and VolaTools. The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The goal behind the open development of the Volatility Framework is to bring together systems researchers who believe in bettering the state of the digital forensics community. The framework is intended to introduce the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work in this exciting area of research. The Volatility Framework runs on any platform where Python is supported.

AAron Walters publishes FATKit: Detecting Malicious Library Injection and Upping the “Anti”, which discusses how the Forensic Analysis ToolKit (FATKit) can facilitate the process of enumerating suspicious artifacts manifested as a result of remote library injection. Previously published techniques focused on detecting attacks in real time, but this paper specifically focuses on the ability to extract memory-resident evidence from information systems under investigation. One significant differentiator from the majority of previous work is that the integrity of the potentially compromised operating system is not relied upon; instead, analysis is performed offline on a trusted capture of volatile memory (RAM).