LiME (Linux Memory Extractor) is a loadable kernel module for acquiring volatile memory from Linux and Android systems. It produces captures for subsequent examination with memory forensics tools.
Acquisition takes place within the kernel, reducing interaction with userspace processes. Loading the module still changes the target system’s memory, and optional hashing and compression introduce additional overhead.
This is free and open source software.
Key Features
- Capture physical memory to a local file or transmit it over TCP to a receiving machine.
- LiME output format records each memory range with a header containing its physical address information.
- Padded output fills gaps between RAM ranges with zeroes, preserving their physical offsets.
- Raw output concatenates RAM ranges without preserving their original positions. This mode is intended for advanced users and limits compatibility with forensic tools.
- Optional hashing uses algorithms available through the kernel’s cryptographic library, including SHA-256 and SHA-512.
- Store the calculated digest in a separate file for integrity checking. Network acquisition provides the digest through an additional connection.
- Optional zlib compression reduces capture size and can improve transfer speed. The digest corresponds to the uncompressed data.
- Support direct disk I/O where available.
- Restrict the TCP listener to localhost when using local connections or port forwarding.
- Configure read/write timeouts to skip stalled memory ranges, or disable the timeout to continue acquiring slow regions.
Website: github.com/jtsylve/LiME
Support:
Developer: Joe Sylve and contributors
License: GNU General Public License v2.0
LiME is written in C. Learn C with our recommended free books and free tutorials.
Related Software
| Forensics Memory Tools | |
|---|---|
| MemProcFS | View physical memory as files in a virtual file system |
| pypykatz | Python implementation of Mimikatz |
| PCILeech | Security research and memory acquisition tool |
| Volatility | Advanced memory forensics framework |
| AVML | Acquire Volatile Memory for Linux |
| Volshell | CLI tool for working with memory |
| LeechCore | Physical memory acquisition library |
| EVTXtract | Recovers and reconstructs fragments of EVTX log files |
| mquire | Memory forensics and analysis tool |
| LEMON | Memory acquisition utility |
| yarp | Yet Another Registry Parser |
| emd | Command line memory acquisition tool for Linux systems |
| AutoTimeliner | Extract forensic timeline from volatile memory dump |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.