Awesome Incident Response
Section: Memory Analysis Tools · Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD.
FreshScore 89
Entry
LiME
Appears in 5 awesome lists
Linux kernel module for acquiring memory dumps, older than AVML but supporting additional formats and more kernel versions. With 1,700+ GitHub stars, it remains a standard tool for Linux memory acquisition in incident response engagements where kernel module loading is permitted.
Open github.com504ensicslabs/lime
Found in these lists
Awesome Security
Section: Forensics · Linux Memory Extractor
SlowScore 68
Forensics Tools
Section: Acquisition · Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD
FreshScore 86
Hacking Tools
Section: Incident Response · Linux kernel module for acquiring memory dumps, older than AVML but supporting additional formats and more kernel versions. With 1,700+ GitHub stars, it remains a standard tool for Linux memory acquisition in incident response engagements where kernel module loading is permitted.
FreshScore 91
Security lists for SOC/DFIR detections
Section: General
FreshScore 85
Often listed next to it
Volatility
Python based memory extraction and analysis framework.
In 8 listsDetails
GRR Rapid Response
Incident response framework focused on remote live forensics. It consists of a python agent (client) that is installed on target systems, and a python server infrastructure that can manage and talk to the agent. Besides the included Python API client, PowerGRR provides an API client library in…
In 7 listsDetails
Maigret
Maigret collect a dossier on a person by username only, checking for accounts on a huge number of sites and gathering all the available information from web pages.
In 6 listsDetails
Velociraptor
Digital forensics and incident response platform that doubles as a powerful endpoint threat-hunting tool, with a specialized query language for interrogating host state, remote forensic collection across fleets, and a notebook environment for collaborative investigation workflows.
In 6 listsDetails
Volatility 3
The reference framework for memory forensics with 2,500+ GitHub stars, rewritten in Python 3 with a modular plugin architecture supporting Windows XP through 11, Server equivalents, and Linux 2.6.18 through latest kernels. Essential plugins include windows.pslist and windows.psscan for listing…
In 5 listsDetails
AVML
Microsoft's static binary for acquiring memory on Linux systems during incident response, designed for environments where software installation is not possible. Generates dumps compatible with Volatility and LiME, with 700+ GitHub stars and active maintenance. Portable with no dependencies, making…
In 4 lists
Rekall
Open source tool (and library) for the extraction of digital artifacts from volatile memory (RAM) samples.
In 4 lists
Logdissect
CLI utility and Python API for analyzing log files and other data. (MIT)
In 4 lists