Skip to content

Update macOS tutorial with support warning #1963

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
cpuu wants to merge 2 commits into from
Closed

Update macOS tutorial with support warning #1963

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7451e7f
Update macOS tutorial with support warning
cpuu Mar 17, 2026
863cec1
Update overview section of macOS tutorial
cpuu Mar 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions doc/source/getting-started-mac-tutorial.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,14 @@
macOS Tutorial
==============

.. warning::

**As of the `Official Parity Release of Volatility 3 <https://volatilityfoundation.org/announcing-the-official-parity-release-of-volatility-3/>`_ (v2.26.0) announced on May 16, 2025, macOS is no longer officially supported by the Volatility Foundation.** Ongoing development and maintenance will be focused exclusively on **Windows and Linux** memory analysis.

The primary reason for this discontinuation is the increased complexity of memory acquisition on modern macOS. Apple’s stringent security policies—specifically **System Integrity Protection (SIP)** and **Kernel Lockdown**—have made it nearly impossible for open-source frameworks to reliably access kernel memory without significant, intrusive modifications to the target system.

While this tutorial remains available for educational purposes and for analyzing older macOS memory samples, it is not recommended for modern investigative workflows. If you require macOS memory forensics capabilities for **enterprise or professional investigative environments**, we recommend exploring commercial solutions such as those provided by **Volexity**, which is led by members of the Volatility core development team.

This guide will give you a brief overview of how volatility3 works as well as a demonstration of several of the plugins available in the suite.

Acquiring memory
Expand Down
Loading