volatility.cli package

A CommandLine User Interface for the volatility framework.

User interfaces make use of the framework to:
  • determine available plugins

  • request necessary information for those plugins from the user

  • determine what “automagic” modules will be used to populate information the user does not provide

  • run the plugin

  • display the results

class CommandLine[source]

Bases: volatility.framework.interfaces.plugins.FileConsumerInterface

Constructs a command-line interface object for users to run plugins.


Consumes a file as produced by a plugin.

populate_config(context, configurables_list, args, plugin_config_path)[source]

Populate the context config based on the returned args.

We have already determined these elements must be descended from ConfigurableInterface

  • context (ContextInterface) – The volatility context to operate on

  • configurables_list (Dict[str, ConfigurableInterface]) – A dictionary of configurable items that can be configured on the plugin

  • args (Namespace) – An object containing the arguments necessary

  • plugin_config_path (str) – The path within the context’s config containing the plugin’s configuration

Return type


populate_requirements_argparse(parser, configurable)[source]

Adds the plugin’s simple requirements to the provided parser.


Provide useful feedback if an exception occurs.


Executes the command line module, taking the system arguments, determining the plugin to run and then running it.

class HelpfulSubparserAction(*args, **kwargs)[source]

Bases: argparse._SubParsersAction

Class to either select a unique plugin based on a substring, or identify the alternatives.

add_parser(name, **kwargs)
class MuteProgress[source]

Bases: volatility.cli.PrintedProgress

A dummy progress handler that produces no output when called.

class PrintedProgress[source]

Bases: object

A progress handler that prints the progress value and the description onto the command line.


A convenience function for constructing and running the CommandLine’s run method.