dfirtriage

dfirtriage Digital forensic acquisition tool for Windows-based incident response. How to Use To run, drop dfirtriage.exe on the target or connected USB drive and execute with admin rights, -h for help. DFIRTriage v6.0 User's Manual Description This document outlines the functionality and proper u...

Linpmem

Linpmem -- a physical memory acquisition tool for Linux Linpmem is a Linux x64-only tool for reading physical memory. Like its Windows counterpart, Winpmem, this is not a traditional memory dumper. Linpmem offers an API for reading from any physical address, including reserved memory and memory...

LiME

LiME Linux Memory Extractor A Loadable Kernel Module LKM for volatile memory acquisition from Linux and Linux-based devices, such as Android. LiME minimizes its interaction between user and kernel space processes during acquisition, producing memory captures that are more forensically sound than...

WinPmem

WinPmem -- una herramienta de adquisición de memoria física WinPmem ha sido el controlador de adquisición de memoria de código abierto predeterminado para Windows durante mucho tiempo. Antes formaba parte del proyecto Rekall, pero recientemente se ha separado en su propio repositorio. Esta es la...

pcileech

Resumen de PCILeech: PCILeech utiliza dispositivos hardware PCIe para leer y escribir la memoria del sistema objetivo. Esto se logra usando DMA a través de PCIe. No se necesitan controladores en el sistema objetivo. PCILeech también funciona sin hardware junto con una amplia gama de métodos de...

avml

AVML Linux용 휘발성 메모리 획득 요약 Linux용 휴대용 휘발성 메모리 획득 도구. AVML은 Rust로 작성된 X8664 사용자 영역userland 휘발성 메모리 획득 도구로, 정적 바이너리로 배포되도록 설계되었습니다. AVML은 대상 OS 배포판이나 커널을 사전에 알지 못해도 메모리를 획득할 수 있습니다. 대상 시스템에서의 컴파일이나 핑거프린팅이 필요하지 않습니다. 기능 Azure Blob Store 또는 HTTP PUT을 통해 캡처한 이미지를 외부 위치에 저장 Azure Blob Storage 업로드는 Azure...

gargamel

Gargamel Compilar Compilado y probado con Rust 1.50+. Abra una terminal en el directorio del proyecto y para compilar una versión de lanzamiento escriba root@kitploit: cargo build --release La compilación de depuración se puede compilar usando root@kitploit: cargo build El ejecutable compilado se...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from a race condition in memory acquisition. This condition may lead to competition when sharing...

Bringing Forensic Readiness to Modern Computer Firmware

Today's computer systems come with a pre-installed tiny operating system, which is also known as UEFI. UEFI has slowly displaced the former legacy PC-BIOS while the main task has not changed: It is responsible for booting the actual operating system. However, features like the network stack make ...

WinPmem 安全漏洞

WinPmem is an open source physical memory acquisition tool from Velocidex. A security vulnerability exists in WinPmem version 4.1 and earlier versions that stems from improper validation of input...

Linpmem - A Physical Memory Acquisition Tool For Linux

Like its Windows counterpart, Winpmem, this is not a traditional memory dumper. Linpmem offers an API for reading from any physical address, including reserved memory and memory holes , but it can also be used for normal memory dumping. Furthermore, the driver offers a variety of access modes to...

WinPmem - The Multi-Platform Memory Acquisition Tool

The WinPmem memory acquisition driver and userspace WinPmem has been the default open source memory acquisition driver for windows for a long time. It used to live in the Rekall project, but has recently been separated into its own repository. Copyright This code was originally developed within...

Linux Memory Extractor: LiME

Linux Memory Extractor LiME formerly DMD is A Loadable Kernel Module LKM which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its...

LiME - Linux Memory Extractor

A Loadable Kernel Module LKM which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its interaction between user and kernel space...

Rekall Memory Forensic Framework

Rekall is an advanced forensic and incident response framework. While it began life purely as a memory forensic framework, it has now evolved into a complete platform. Rekall implements the most advanced analysis techniques in the field, while still being developed in the open, with a free and op...

[Memoryze] Find Evil in Live Memory (Memory Forensic Software)

Mandiant’s Memoryze is free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the paging file in its analysis. Mandiant’s Memoryze features: image the full range of system memory no...

[MoonSols] Windows Memory Toolkit

MoonSols Windows Memory Toolkit is a powerful toolkit containing all the utilities needed to perform any kind of memory acquisition or conversion during an incident response, or a forensic analysis for Windows desktops, servers or virtualized environment. The version 2.0 is a refresh and updated...