Volatility, Now at 599x

Every memory forensics practitioner knows the pain. You point Volatility 3 at a multi-gigabyte dump, then wait. And wait. The Python reference implementation is correct, battle-tested, and slow as mud on anything bigger than a laptop image.

vol-rs changes that calculus. It's a from-scratch port of Volatility 3 from Python to Rust, created by daffainfo and released yesterday. The goal: identical output, dramatically less waiting.

The numbers

They ran both tools against the same captures and diffed everything — header framing, trailing newlines, the works:

• 99 of 100 Windows plugins produce byte-for-byte identical output
• 56 of 57 Linux plugins — same story
• 1,747 extracted files compared, every one equal
• 197 of 197 plugin help pages identical, character for character

And the speed gap is not "a bit faster." It's transformative:

• Windows sweep: 273 seconds (Rust) vs 5,723 seconds (Python) — 21x
• Linux sweep: 68 seconds vs 3,130 seconds — 46x
• Peak individual plugin: windows.malware.suspicious_threads.SuspiciousThreads at 599x (0.47s vs 281.6s)
• Malfind: 455x faster. VadInfo: 333x. LibraryList (Linux): 396x.

Why this matters

Memory forensics workflows are bottlenecked on analysis time, not acquisition. An incident responder triaging a server dump today has to wait minutes per plugin. With vol-rs, most run sub-second. That's the difference between "let me get back to you" and "here's your answer during the call."

Also worth noting: zero external dependencies. Everything the Python version reaches for via pycryptodomex, yara-python, capstone, and pillow is compiled in. One binary, no virtualenv, no "oh, that symbol pack path is wrong" nonsense.

The catch

Two plugins fail to finish in Python on the test machine (OOM-killed past 7.8 million lines). The vol-rs version reproduces every line Python managed to write before dying. The eight non-identical files across 1,747 comparisons are all edge cases where Python leaves partial artifacts on error.

For forensics work, trust has to be earned. Publishing a full diff table and calling out every discrepancy is the right move.

101 stars in its first day. Watch this one.