fvol

Highlights

• All 197 plugins of volatility3 2.28.2, with the same options, --help, errors and exit codes.
• 356-473x faster than python and 12-29x faster than vol-rs on a first triage session (how measured).
• Zero dependencies: one static binary, Rust standard library only.
• Every common format: raw, LiME, ELF core, crash dump, VMware, QEMU, AVML, Xen, gzip/bzip2/xz.
• Built-in web UI: fvol serve.
• Tab autocomplete commands

Install

Requires Rust 1.95+. Linux on x86-64 and arm64.

cargo build --release    # -> target/release/fvol

[!NOTE] The build targets the build machine's CPU; for a portable binary see docs/building.md.

Quick start

eval "$(fvol completion bash)"                           # TAB-complete plugins and options
fvol -f memory.raw windows.pslist.PsList                 # run a plugin
fvol -h                                                  # list plugins
fvol -s ./symbols -f linux.lime linux.pslist.PsList      # Linux/macOS: symbol dir
fvol -f memory.raw -o out/ windows.dlllist.DllList --dump # dump files
fvol -f memory.raw -r json windows.pslist.PsList         # quick, pretty, csv, json, jsonl
fvol --version                                           # version banner

Windows symbols are downloaded automatically. See docs/usage.md.

Web UI

fvol serve -f memory.raw   # prints a local URL with an access token

Pick plugins or a preset, run them together, and read the results a tab per plugin: million-row tables, one filter across all plugins, process trees, exports, every fvol option and your own triage rules. Everything is saved in ~/.fvol and comes back when the dump is reopened. Localhost only, token-protected. docs/web-ui.md

Supported images

Formats: raw, LiME, ELF core, Windows crash dump, VMware, QEMU savevm, AVML, Xen; gzip/bzip2/xz compressed; http(s):// URLs; Windows page files.

Verification

Every plugin's stdout, exit code and dumped files are diffed against python volatility3 2.28.2:

³ Except the documented gaps in differences.md. How to run the gates: docs/development.md.

Performance

Measured on a desktop: Intel Core i7-12700KF (12 cores, 20 threads), 64 GB RAM, NVMe SSD, Linux 7.1.8. Medians of repeated runs, every run a separate process. Method, all numbers and raw data: bench/local/BENCHMARKS.md.

Triage session: the common plugins run one after another on an image the tool has not seen (its cache empty at the start; python's symbol caches warm).

Every plugin once: per-plugin speedup, geometric mean (a sum would be dominated by the few slowest plugins).

windows.pslist from start to exit: python 537 ms, vol-rs 270 ms cold / 49.8 ms warm, fastvol 21.7 ms cold / 1.3 ms warm.

¹ python decompresses and parses the kernel's 61 MB JSON symbol file on every Linux run; fastvol keeps a binary symbol table in its cache. The no-cache column is the conservative comparison.<br> ² windows.windows: python iterates a set, so its row order changes from run to run; fastvol's output equals python's after sorting (details).

Why it's fast: memory-mapped images and symbol tables, all-core scanning, lazy loading, content-keyed caches that can't change output, and from-scratch libraries that beat the C originals. docs/architecture.md

Documentation

License

Volatility Software License 1.0, as a port of Volatility 3 (LICENSE.txt).

fastvol is built on the work of the Volatility Foundation and the volatility3 contributors. It is an independent project, not affiliated with or endorsed by the Volatility Foundation.