volatilityfoundation/volatility3 v2.27.0

Volatility 3 2.27.0

on GitHub

• New plugin:
  • windows.pebmasquerade
• Improved linux.malfind and linux.lsof
• Slightly improved pdb scanning
• Fixed linux mount enumeration
• Behind the scenes improvements on the framework
• Added arrow/parquet format renderer
• Enhanced windows.dlllist plugin
• Improved windows.vadyarascan plugin
• Windows executable included as part of the release cycle

Known issues

• There is a known issue affecting volatility3's ability to handle certain specific Windows 11 images.
  A fix should be included in the next release, see #1929 for more.
• The arrow/parquet support is NOT included in the windows binary file for this release.
  This should be resolved by the next release, see #1936 for more.

New Contributors

• @blitztide made their first contribution in #1871
• @tvanegro made their first contribution in #1853

Full Changelog: v2.26.2...v2.27.0