/projects/volmemlyzer-dfir-automation
VolMemLyzer: Automated Memory-Forensics Orchestration
A modular Python toolkit over Volatility 3 for cached and parallel plugin execution, registry-driven feature extraction, normalized artifacts, and stepwise DFIR triage.
Overview
VolMemLyzer is a Python toolkit for repeatable memory-forensics extraction and analyst-oriented triage over Volatility 3. It connects raw plugin execution, structured artifacts, feature extraction, and investigative views without hiding the underlying commands or evidence.
Analyst and research problem
Running a large collection of memory plugins manually creates duplicated work, inconsistent file naming, format mismatches, and fragile experiment pipelines. Research workflows also need stable features across many images, while incident responders need a smaller set of explainable triage steps.
My role
I developed and extended the core Python architecture for VolMemLyzer, including plugin orchestration, caching, parallel execution, registry-driven feature extraction, structured artifact conversion, analyst-oriented triage, and reliability handling around Volatility 3.
Package architecture
The code separates responsibilities into a command runner, extractor registry, orchestration pipeline, artifact converters, analysis modules, terminal presentation, and CLI. That structure allows the same operations to be used interactively or imported into research scripts.
Pipeline orchestration
The registry binds Volatility plugin specifications to extractor functions and their dependencies. The pipeline resolves those dependencies in topological layers, executes independent work concurrently, and returns explicit artifact paths and structured action results.
Cache, conversion, and timeout behavior
Before rerunning a plugin, the pipeline checks for an exact cached artifact. When possible, it converts compatible JSON, JSONL, or CSV output into the requested format. Per-plugin timeouts and stderr artifacts contain failures without silently dropping a result.
Structured feature generation
Registry-driven extractors normalize process, registry, network, VAD, service, thread, module, DLL, handle, and kernel evidence. Deterministic names and stable feature keys make those artifacts usable in both forensic review and machine-learning datasets.
DFIR triage workflow
The analysis layer organizes evidence into progressive steps: establish process bearings, inspect suspicious execution and injection evidence, correlate network and persistence artifacts, and retain links to the source plugin output. Rich terminal tables keep the workflow readable without replacing the raw records.
Reliability boundaries
VolMemLyzer inherits the symbol coverage and plugin behavior of Volatility 3. Cache reuse must be disabled when fresh execution is required, and normalized features still need case-specific interpretation. The tool accelerates repeatable analysis; it does not automate forensic conclusions.