.gitignore
.readthedocs.yml
.style.yapf
LICENSE.txt
MANIFEST.in
README.md
mypy.ini
setup.py
vol.py
vol.spec
volshell.py
volshell.spec
doc/Makefile
doc/make.bat
doc/source/basics.rst
doc/source/complex-plugin.rst
doc/source/conf.py
doc/source/index.rst
doc/source/simple-plugin.rst
doc/source/symbol-tables.rst
doc/source/using-as-a-library.rst
doc/source/vol-cli.rst
doc/source/vol2to3.rst
doc/source/_static/favicon.ico
doc/source/_static/vol.png
volatility3/__init__.py
volatility3.egg-info/PKG-INFO
volatility3.egg-info/SOURCES.txt
volatility3.egg-info/dependency_links.txt
volatility3.egg-info/entry_points.txt
volatility3.egg-info/requires.txt
volatility3.egg-info/top_level.txt
volatility3/cli/__init__.py
volatility3/cli/text_renderer.py
volatility3/cli/volargparse.py
volatility3/cli/volshell/__init__.py
volatility3/cli/volshell/generic.py
volatility3/cli/volshell/linux.py
volatility3/cli/volshell/mac.py
volatility3/cli/volshell/windows.py
volatility3/framework/__init__.py
volatility3/framework/exceptions.py
volatility3/framework/automagic/__init__.py
volatility3/framework/automagic/construct_layers.py
volatility3/framework/automagic/linux.py
volatility3/framework/automagic/mac.py
volatility3/framework/automagic/pdbscan.py
volatility3/framework/automagic/stacker.py
volatility3/framework/automagic/symbol_cache.py
volatility3/framework/automagic/symbol_finder.py
volatility3/framework/automagic/windows.py
volatility3/framework/configuration/__init__.py
volatility3/framework/configuration/requirements.py
volatility3/framework/constants/__init__.py
volatility3/framework/constants/linux/__init__.py
volatility3/framework/constants/windows/__init__.py
volatility3/framework/contexts/__init__.py
volatility3/framework/interfaces/__init__.py
volatility3/framework/interfaces/automagic.py
volatility3/framework/interfaces/configuration.py
volatility3/framework/interfaces/context.py
volatility3/framework/interfaces/layers.py
volatility3/framework/interfaces/objects.py
volatility3/framework/interfaces/plugins.py
volatility3/framework/interfaces/renderers.py
volatility3/framework/interfaces/symbols.py
volatility3/framework/layers/__init__.py
volatility3/framework/layers/crash.py
volatility3/framework/layers/elf.py
volatility3/framework/layers/intel.py
volatility3/framework/layers/lime.py
volatility3/framework/layers/linear.py
volatility3/framework/layers/msf.py
volatility3/framework/layers/physical.py
volatility3/framework/layers/qemu.py
volatility3/framework/layers/registry.py
volatility3/framework/layers/resources.py
volatility3/framework/layers/segmented.py
volatility3/framework/layers/vmware.py
volatility3/framework/layers/codecs/__init__.py
volatility3/framework/layers/scanners/__init__.py
volatility3/framework/layers/scanners/multiregexp.py
volatility3/framework/objects/__init__.py
volatility3/framework/objects/templates.py
volatility3/framework/objects/utility.py
volatility3/framework/plugins/__init__.py
volatility3/framework/plugins/banners.py
volatility3/framework/plugins/configwriter.py
volatility3/framework/plugins/frameworkinfo.py
volatility3/framework/plugins/isfinfo.py
volatility3/framework/plugins/layerwriter.py
volatility3/framework/plugins/timeliner.py
volatility3/framework/plugins/yarascan.py
volatility3/framework/plugins/linux/__init__.py
volatility3/framework/plugins/linux/bash.py
volatility3/framework/plugins/linux/check_afinfo.py
volatility3/framework/plugins/linux/check_creds.py
volatility3/framework/plugins/linux/check_idt.py
volatility3/framework/plugins/linux/check_modules.py
volatility3/framework/plugins/linux/check_syscall.py
volatility3/framework/plugins/linux/elfs.py
volatility3/framework/plugins/linux/keyboard_notifiers.py
volatility3/framework/plugins/linux/lsmod.py
volatility3/framework/plugins/linux/lsof.py
volatility3/framework/plugins/linux/malfind.py
volatility3/framework/plugins/linux/proc.py
volatility3/framework/plugins/linux/pslist.py
volatility3/framework/plugins/linux/pstree.py
volatility3/framework/plugins/linux/tty_check.py
volatility3/framework/plugins/mac/__init__.py
volatility3/framework/plugins/mac/bash.py
volatility3/framework/plugins/mac/check_syscall.py
volatility3/framework/plugins/mac/check_sysctl.py
volatility3/framework/plugins/mac/check_trap_table.py
volatility3/framework/plugins/mac/ifconfig.py
volatility3/framework/plugins/mac/kauth_listeners.py
volatility3/framework/plugins/mac/kauth_scopes.py
volatility3/framework/plugins/mac/kevents.py
volatility3/framework/plugins/mac/list_files.py
volatility3/framework/plugins/mac/lsmod.py
volatility3/framework/plugins/mac/lsof.py
volatility3/framework/plugins/mac/malfind.py
volatility3/framework/plugins/mac/mount.py
volatility3/framework/plugins/mac/netstat.py
volatility3/framework/plugins/mac/proc_maps.py
volatility3/framework/plugins/mac/psaux.py
volatility3/framework/plugins/mac/pslist.py
volatility3/framework/plugins/mac/pstree.py
volatility3/framework/plugins/mac/socket_filters.py
volatility3/framework/plugins/mac/timers.py
volatility3/framework/plugins/mac/trustedbsd.py
volatility3/framework/plugins/mac/vfsevents.py
volatility3/framework/plugins/windows/__init__.py
volatility3/framework/plugins/windows/bigpools.py
volatility3/framework/plugins/windows/cachedump.py
volatility3/framework/plugins/windows/callbacks.py
volatility3/framework/plugins/windows/cmdline.py
volatility3/framework/plugins/windows/dlllist.py
volatility3/framework/plugins/windows/driverirp.py
volatility3/framework/plugins/windows/driverscan.py
volatility3/framework/plugins/windows/dumpfiles.py
volatility3/framework/plugins/windows/envars.py
volatility3/framework/plugins/windows/filescan.py
volatility3/framework/plugins/windows/getservicesids.py
volatility3/framework/plugins/windows/getsids.py
volatility3/framework/plugins/windows/handles.py
volatility3/framework/plugins/windows/hashdump.py
volatility3/framework/plugins/windows/info.py
volatility3/framework/plugins/windows/lsadump.py
volatility3/framework/plugins/windows/malfind.py
volatility3/framework/plugins/windows/memmap.py
volatility3/framework/plugins/windows/modscan.py
volatility3/framework/plugins/windows/modules.py
volatility3/framework/plugins/windows/mutantscan.py
volatility3/framework/plugins/windows/netscan.py
volatility3/framework/plugins/windows/poolscanner.py
volatility3/framework/plugins/windows/privileges.py
volatility3/framework/plugins/windows/pslist.py
volatility3/framework/plugins/windows/psscan.py
volatility3/framework/plugins/windows/pstree.py
volatility3/framework/plugins/windows/sids_and_privileges.json
volatility3/framework/plugins/windows/ssdt.py
volatility3/framework/plugins/windows/strings.py
volatility3/framework/plugins/windows/svcscan.py
volatility3/framework/plugins/windows/symlinkscan.py
volatility3/framework/plugins/windows/vadinfo.py
volatility3/framework/plugins/windows/vadyarascan.py
volatility3/framework/plugins/windows/verinfo.py
volatility3/framework/plugins/windows/virtmap.py
volatility3/framework/plugins/windows/registry/__init__.py
volatility3/framework/plugins/windows/registry/hivelist.py
volatility3/framework/plugins/windows/registry/hivescan.py
volatility3/framework/plugins/windows/registry/printkey.py
volatility3/framework/plugins/windows/registry/userassist.json
volatility3/framework/plugins/windows/registry/userassist.py
volatility3/framework/renderers/__init__.py
volatility3/framework/renderers/conversion.py
volatility3/framework/renderers/format_hints.py
volatility3/framework/symbols/__init__.py
volatility3/framework/symbols/intermed.py
volatility3/framework/symbols/metadata.py
volatility3/framework/symbols/native.py
volatility3/framework/symbols/wrappers.py
volatility3/framework/symbols/generic/__init__.py
volatility3/framework/symbols/generic/qemu.json
volatility3/framework/symbols/linux/__init__.py
volatility3/framework/symbols/linux/bash.py
volatility3/framework/symbols/linux/bash32.json
volatility3/framework/symbols/linux/bash64.json
volatility3/framework/symbols/linux/elf.json
volatility3/framework/symbols/linux/extensions/__init__.py
volatility3/framework/symbols/linux/extensions/bash.py
volatility3/framework/symbols/linux/extensions/elf.py
volatility3/framework/symbols/mac/__init__.py
volatility3/framework/symbols/mac/extensions/__init__.py
volatility3/framework/symbols/windows/__init__.py
volatility3/framework/symbols/windows/bigpools-vista-x64.json
volatility3/framework/symbols/windows/bigpools-vista-x86.json
volatility3/framework/symbols/windows/bigpools-win10-x64.json
volatility3/framework/symbols/windows/bigpools-win10-x86.json
volatility3/framework/symbols/windows/bigpools-x64.json
volatility3/framework/symbols/windows/bigpools-x86.json
volatility3/framework/symbols/windows/callbacks-x64.json
volatility3/framework/symbols/windows/callbacks-x86.json
volatility3/framework/symbols/windows/crash.json
volatility3/framework/symbols/windows/crash64.json
volatility3/framework/symbols/windows/kdbg.json
volatility3/framework/symbols/windows/netscan-vista-sp12-x64.json
volatility3/framework/symbols/windows/netscan-vista-x64.json
volatility3/framework/symbols/windows/netscan-vista-x86.json
volatility3/framework/symbols/windows/netscan-win10-14393-x86.json
volatility3/framework/symbols/windows/netscan-win10-15063-x64.json
volatility3/framework/symbols/windows/netscan-win10-15063-x86.json
volatility3/framework/symbols/windows/netscan-win10-16299-x64.json
volatility3/framework/symbols/windows/netscan-win10-17134-x64.json
volatility3/framework/symbols/windows/netscan-win10-17134-x86.json
volatility3/framework/symbols/windows/netscan-win10-17763-x64.json
volatility3/framework/symbols/windows/netscan-win10-18363-x64.json
volatility3/framework/symbols/windows/netscan-win10-19041-x64.json
volatility3/framework/symbols/windows/netscan-win10-19041-x86.json
volatility3/framework/symbols/windows/netscan-win10-x64.json
volatility3/framework/symbols/windows/netscan-win10-x86.json
volatility3/framework/symbols/windows/netscan-win7-x64.json
volatility3/framework/symbols/windows/netscan-win7-x86.json
volatility3/framework/symbols/windows/netscan-win8-x64.json
volatility3/framework/symbols/windows/netscan-win8-x86.json
volatility3/framework/symbols/windows/netscan-win81-x64.json
volatility3/framework/symbols/windows/netscan-win81-x86.json
volatility3/framework/symbols/windows/pdb.json
volatility3/framework/symbols/windows/pdbconv.py
volatility3/framework/symbols/windows/pdbutil.py
volatility3/framework/symbols/windows/pe.json
volatility3/framework/symbols/windows/poolheader-x64-win7.json
volatility3/framework/symbols/windows/poolheader-x64.json
volatility3/framework/symbols/windows/poolheader-x86.json
volatility3/framework/symbols/windows/registry.json
volatility3/framework/symbols/windows/services-vista-x64.json
volatility3/framework/symbols/windows/services-vista-x86.json
volatility3/framework/symbols/windows/services-win10-15063-x64.json
volatility3/framework/symbols/windows/services-win10-15063-x86.json
volatility3/framework/symbols/windows/services-win10-16299-x64.json
volatility3/framework/symbols/windows/services-win10-16299-x86.json
volatility3/framework/symbols/windows/services-win8-x64.json
volatility3/framework/symbols/windows/services-win8-x86.json
volatility3/framework/symbols/windows/services-xp-2003-x64.json
volatility3/framework/symbols/windows/services-xp-x86.json
volatility3/framework/symbols/windows/versions.py
volatility3/framework/symbols/windows/extensions/__init__.py
volatility3/framework/symbols/windows/extensions/kdbg.py
volatility3/framework/symbols/windows/extensions/network.py
volatility3/framework/symbols/windows/extensions/pe.py
volatility3/framework/symbols/windows/extensions/pool.py
volatility3/framework/symbols/windows/extensions/registry.py
volatility3/framework/symbols/windows/extensions/services.py
volatility3/plugins/__init__.py
volatility3/plugins/linux/__init__.py
volatility3/plugins/mac/__init__.py
volatility3/plugins/windows/__init__.py
volatility3/plugins/windows/statistics.py
volatility3/plugins/windows/registry/__init__.py
volatility3/plugins/windows/registry/certificates.py
volatility3/schemas/__init__.py
volatility3/schemas/schema-0.1.0.json
volatility3/schemas/schema-2.0.0.json
volatility3/schemas/schema-2.1.0.json
volatility3/schemas/schema-4.0.0.json
volatility3/schemas/schema-4.1.0.json
volatility3/schemas/schema-6.0.0.json
volatility3/schemas/schema-6.1.0.json
volatility3/schemas/schema-6.2.0.json
volatility3/symbols/__init__.py