volatility3.framework.constants package

Volatility 3 Constants.

Stores all the constant values that are generally fixed throughout volatility This includes default scanning block sizes, etc.

AUTOMAGIC_CONFIG_PATH = 'automagic'

The root section within the context configuration for automagic values

BANG = '!'

Constant used to delimit table names from type names when referring to a symbol

CACHE_PATH = '/home/docs/.cache/volatility3'

Default path to store cached data

CACHE_SQLITE_SCHEMA_VERSION = 1

Version for the sqlite3 cache schema

IDENTIFIERS_FILENAME = 'identifier.cache'

Default location to record information about available identifiers

ISF_EXTENSIONS = ['.json', '.json.xz', '.json.gz', '.json.bz2']

List of accepted extensions for ISF files

ISF_MINIMUM_DEPRECATED = (3, 9, 9)

The highest version of the ISF that’s deprecated (usually higher than supported)

ISF_MINIMUM_SUPPORTED = (2, 0, 0)

The minimum supported version of the Intermediate Symbol Format

LOGLEVEL_V = 9

Logging level for a single -v

LOGLEVEL_VV = 8

Logging level for -vv

LOGLEVEL_VVV = 7

Logging level for -vvv

LOGLEVEL_VVVV = 6

Logging level for -vvvv

OFFLINE = False

Whether to go online to retrieve missing/necessary JSON files

PACKAGE_VERSION = '2.4.0'

The canonical version of the volatility3 package

PARALLELISM = Parallelism.Off

Default value to the parallelism setting used throughout volatility

PLUGINS_PATH = ['/home/docs/checkouts/readthedocs.org/user_builds/volatility3/checkouts/v2.4.0/volatility3/plugins', '/home/docs/checkouts/readthedocs.org/user_builds/volatility3/checkouts/v2.4.0/volatility3/framework/plugins']

Default list of paths to load plugins from (volatility3/plugins and volatility3/framework/plugins)

class Parallelism(value)[source]

Bases: IntEnum

An enumeration listing the different types of parallelism applied to volatility.

Multiprocessing = 2
Off = 0
Threading = 1
ProgressCallback

Type information for ProgressCallback objects

alias of Optional[Callable[[float, str], None]]

REMOTE_ISF_URL = None

Remote URL to query for a list of ISF addresses

SQLITE_CACHE_PERIOD = '-3 days'

SQLite time modifier for how long each item is valid in the cache for

SYMBOL_BASEPATHS = ['/home/docs/checkouts/readthedocs.org/user_builds/volatility3/checkouts/v2.4.0/volatility3/symbols', '/home/docs/checkouts/readthedocs.org/user_builds/volatility3/checkouts/v2.4.0/volatility3/framework/symbols']

Default list of paths to load symbols from (volatility3/symbols and volatility3/framework/symbols)

Subpackages