Linux Memory Analysis

From ForensicsWiki
Revision as of 19:42, 13 November 2013 by Andrewtappert (Talk | contribs)

Jump to: navigation, search

The output of a memory acquisition tool is a memory image which contains the raw physical memory of a system. A wide variety of tools can be used to search for strings or other patterns in a memory image, but to extract higher-level information about the state of the system a memory analysis tool is required.

Linux Memory Analysis Tools

Active Open Source Projects:

Commercial Products:

  • Second Look provides memory acquisition and analysis tools for Linux incident response and enterprise security. Its major differentiators versus Volatility are malware detection via integrity verification of the kernel and running processes, ease of use (automatic kernel version detection, a graphical user interface, etc.), and enterprise scalability (including live analysis of remote systems via a memory access agent). (Availability/License: commercial)

Inactive Open Source and Research Projects:

  • The Forensic Analysis Toolkit (FATKit) is a cross-platform, modular, and extensible digital investigation framework for analyzing volatile system memory. (Publication Date: 2006; Availability/License: not available)
  • Foriana is tool for extraction of information such as the process and modules lists from a RAM image using logical relations between OS structures. (Availability/License: GNU GPL)
  • Draugr is a Linux memory forensics tool written in Python. (Availability/License: GNU GPL)
  • Volatilitux is another Linux memory forensics tool written in Python. (Availability/License: GNU GPL)
  • Idetect (Linux) is an older implementation of Linux memory analysis.

Linux Memory Analysis Challenges

Linux Memory Images

Aside from those in the challenges referenced above, sample Linux memory images can also be found on the Second Look web site at

Linux Memory Analysis Bibliography

Volatility Mailing List Threads on Support for Linux: