Rust 1.85 buys a familiar Volatility command line
vol-rs requires Rust 1.85 or newer and aims to preserve Volatility 3's plugin names, options, defaults, and rendered output. An investigator can point it at a memory image, select a plugin such as windows.pslist or linux.bash, and choose familiar renderers. That compatibility is the reason to care. This is a port for people with existing Volatility habits, rather than a new forensic workflow that asks them to relearn the job.
The 8.7 MB checkout contains built-in support for jobs that Python Volatility commonly hands to separate libraries: crypto, YARA matching, x86 disassembly, PNG output, and tar archives. Windows kernel symbols can come from Microsoft's symbol server, after which vol-rs converts and caches them. Local symbol packs live under the XDG data directory by default, and another directory can be supplied through a flag or environment variable. An air-gapped lab still needs to stage those files before analysis.
All 266 tests passed, while the release build took 218 seconds
Our run at commit 4c1076f installed 344 packages in 10 seconds. The release build succeeded, but it needed 218 seconds on the stated 3-CPU, 12 GB sandbox. That is a one-time compilation cost for a pinned binary, not evidence about plugin speed on a memory image. The project README publishes its own comparison tables, but our sandbox did not reproduce those forensic workloads, so we would benchmark the exact plugins and captures used by a team before changing a case workflow.
The test result was cleaner: cargo finished 266 tests in 27 seconds with no failures. The repository has a dedicated tests directory and 348 tracked files, with roughly 64,975 lines of source. Those numbers make the port inspectable, yet they do not prove that every parser is safe against hostile evidence or that every plugin matches upstream on every operating-system build. They show that the checked commit installed, compiled, and completed its supplied suite in our container.
What happened when we ran it
Our sandbox installed vol-rs in 10 seconds, built it in 218 seconds, and passed 266 of 266 tests in another 27 seconds. Nothing in those three steps failed. The build was the expensive part by a wide margin, while the complete test command took less than one seventh as long. We used an unprivileged container with no secrets, so this result covers repository setup and tests without claiming that a real evidence image was processed.
The checkout occupied 8.7 MB before the 344-package install. It included one CI workflow, no Dockerfile, and a tests directory. A Docker-based lab must write its own image or start from a Rust base. Anyone who does not want to compile can use v1.0.1 archives for Linux on two architectures, macOS on two architectures, or 64-bit Windows; the release also provides SHA-256 files for each archive.
v1.0.1 fixed concrete parser and release faults
Release v1.0.1 landed on September 12, 2026. Its notes say malformed AVML and ELF inputs now return an error instead of crashing, Windows kernel symbol fetching now works without Python Volatility installed beside the binary, and release assets are built from the tag to which they are attached. Short plugin names also work in that release. These are practical fixes for evidence handling and artifact traceability, not cosmetic release notes.
The repository's only open item is issue 3, which asks for mandatory tests, formatting, linting, dependency auditing, and malformed-input checks in CI. The current workflow builds locked release binaries across five platform targets and verifies tag identity, but it does not run the 266-test suite. A passing local suite and a release-only workflow answer different questions: one checks the commit we ran, while the other controls what future changes must pass before an artifact is published.
Real-capture coverage stops short of every advertised parser
The README names Windows 10 build 19045 and Linux 6.8 as its real-capture base. It also says the macOS plugins have been reviewed against published Darwin symbols but have not been run against a real Mac image. Only 64-bit captures received the documented evidence checks. If your work involves 32-bit Intel or PAE paging, passing unit tests are the project's stated evidence today.
Input formats have a similar boundary. VMware and LiME captures were used for real checks, while crash dump, AVML, QEMU, ELF core, and Xen paths remain on the to-do list for evidence-based validation. Arrow and Parquet renderers are accepted at the command line but deliberately refused. These admissions are good documentation. They also provide a simple adoption rule: verify your capture type, operating-system generation, and required output before making vol-rs the only tool in a case.
A September push shows maintenance, not long field history
GitHub recorded the last push on September 12, 2026, when v1.0.1 was published. The repository had 187 stars and one combined open issue or pull request when fetched. It was created on August 30, so active maintenance and a recent release are visible, while years of operational history are not. The Volatility Software License also applies because the project describes itself as an Addition derived from Volatility 3.
vol-rs is worth running beside Python Volatility on the Windows and Linux evidence your team already understands. The 266 passing tests and explicit compatibility target give that trial a better base than the project's age suggests. Its own limits should decide promotion: keep the upstream tool available until your actual capture formats and plugins produce matching results, and do not treat a compiled port as Foundation endorsement.