awesome-memory-forensics - A curated list of awesome Memory Forensics for DFI

项目说明

Awesome Memory Forensics ![Awesome]()

A curated list of awesome Memory Forensics for DFIR.

> Memory Forensics is forensic analysis of a computer's memory dump. Its primary application is in of ad computer attacks which are stealthy enough to avoid leaving data on the computer's hard dri, the memory (RAM) must be analyzed for forensic information.

If you want to contribute, please read the contribution guidelines.

Contents

Tool

Books

Course

Articles

Papers

Datasets

Challenges

Contributors

Tool

Memory Acquisition

Introduce commercial and open source tools for memory acquisition.

#### Software

Surge - 's Surge Collect offers flexible storage options and an intuiti that any responder can run to eliminate the issues associated with the corrupt data samples, crashed target computers, and ultimately, unusable data that commonly results from using other tools.

MAGNET RAM - MAGNET RAM Capture is a free imaging tool designed to capture the physical memory of a suspect's computer, allowing in to recover and analyze artifacts that are often only found in memory.

FTK Imager - FTK® Imager is a data preview and imaging tool that lets you quickly assess electronic e to determine if further analysis with a forensic tool such as Forensic Toolkit (FTK®) is warranted.

Winpmem - WinPmem has been the default open source memory acquisition driver for windows for a long time.

Ram Capturer - Belkasoft Live RAM Capturer is a tiny free forensic tool that allows to reliably extract the entire contents of computer's memory—even if protected by an acti or anti-dumping system.

LiME(Not actively maintained 😵🍋‍🟩) - A Loadable Kernel Module (LKM) which allows for memory acquisition from Linux and Linux-based devices, such as Android.

AVML - AVML is an X86_64 userland memory acquisition tool written in Rust, intended to be deployed as a static binary.

fmem - This module creates /dev/fmem device, that can be used for dumping physical memory, without limits of /dev/mem (1MB/1GB, depending on distribution).

FEX Memory Imager - FEX Memory Imager (FEX Memory) is a free imaging tool designed to capture the physical Random Access Memory (RAM) of a suspect's running computer. This allows in to recover and analyze artifacts found only in memory.

MacQuisition

Digital Collector - A powerful forensic imaging software solution to perform triage, live data acquisition and targeted data collection for Windows and Mac computers.

varc - Artifact Collector gathers a snapshot of data from a system.

#### Hardware

PCILeech - PCILeech uses PCIe hardware devices to read and write target system memory. This is achieved by using DMA over PCIe. No drivers are needed on the target system.

#### Misc

E - E recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.

Inodes Plugin - The plugin is a pushed of the lsof plugin extracting inode metadata information from each files.

Prefetch Plugin - The plugin is scanning, extracting and parsing Windows Prefetch files from Windows XP to Windows 11.

Memory Analysis

Introduce commercial and open source tools for memory analysis.

- A comprehensi, next- generation memory analysis solution, Professional's powerful core extracts, indexes, and correlates artifacts to provide unprecedented into systems' runtime state and trustworthiness.

- is the world's most widely used framework for extracting digital artifacts from memory (RAM) samples.

MemProcFS - The Memory Process File System (MemProcFS) is an easy and con way of physical memory as files in a file system.

WinDbg - The Windows Debugger (WinDbg) can be used to debug kernel-mode and user-mode code, analyze crash dumps, and examine the CPU registers while the code executes.

- The Framework is a completely open collection of tools,

implemented in Python under the GNU General Public License, for the
extraction of digital artifacts from memory (RAM) samples.

- macOS Memory Analysis Toolkit' is de on Python 2.x (*Deprecated*)

Rekall - A new branch within the project was created to explore how to make the code base more modular, impro, and increase usability. (*Deprecated*)

Redline - Redline®, FireEye's premier free endpoint security tool, provides host in capabilities to users to find signs of malicious activity through memory and file analysis and the de of a threat assessment profile.

Memoryze - Mandiant's Memoryze™ is free memory forensic software that helps incident responders find evil in li. Memoryze can acquire and/or analyze memory images and on li can include the paging file in its analysis.

dwarf2json - Go utility that processes files containing symbol and type information to generate Intermediate Symbol File (ISF) JSON output suitable for Linux and macOS analysis.

Books

The Art of Memory Forensics - Detecting Malware and Threats in Windows, Linux, and Mac Memory.

Practical Memory Forensics - Jumpstart effecti analysis of memory.

Course

Malware and Memory Forensics Training

A Complete Practical Approach To Malware Analysis And Memory Forensics - 2022 Edition

13 Cubed

Introduction to Memory Forensics

Windows Memory Analysis

Windows Process Genealogy

Windows Process Genealogy (Update)

Memory Forensics Baselines

Extracting Prefetch from Memory

Detecting Persistence in Memory

Introduction to Redline

Introduction to Redline (Update)

Profiling Network Activity with 3 - GeoIP from Memory

Profiles and Windows 10

Dumping Processes with 3

First Look at 3 Public Beta

3 and WSL 2 - Linux DFIR Tools in Windows?

MemProcFS - This Changes E

DFIR Science

Introduction to Memory Forensics with 3

Amazon AWS EC2 Forensic Memory Acquisition - LiME

Forensic Memory Acquisition in Linux - LiME

Forensic Memory Acquisition in Windows - FTK Imager

Fast password cracking - Hashcat wordlists from RAM

What is Random Access Memory?

Forensics: What data can you find in RAM?

Black Hat 2022

New Memory Forensics Techniques to Defeat Device Monitoring Malware

Black Hat 2019

In Malware Using Memory Forensics - A Practical Approach

Black Hat 2012

One-byte Modification for Breaking Memory Forensic Analysis

SANS Digital Forensics and Incident Response

SANS DFIR Webcast - Memory Forensics for Incident Response

ETC

Memory Forensics with Jupyter Notebooks

Articles

JPCERT

How to Use 3 Offline

Migrate Plugins 2 to 3

MalConfScan with Cuckoo: Plugin to Automatically Extract Malware Configuration

Plugin for Detecting RedLea

A New Tool to Detect Known Malware from Memory Images – impfuzzy for –

A Plugin Created for Detecting Malware Used in Targeted Attacks

Plugin for Detecting Cobalt Strike Beacon

Blogs

📦 Windows Plugin : Prefetch

📦 Linux Plugin : Inodes

Memory analysis using (1) - Windows 11

Memory analysis using (2) - Ubuntu Linux

Memory analysis using (3) - macOS

Realizing Windows Memory Forensics with and Gimp

CheastSheet

CheatSheet

WriteUps

Papers

Digital In

The e beyond the wall: Memory forensics in SGX en

DFRWS USA 2022

Memory Analysis of .NET and .Net Core Applications

Juicing V8: A Primary Account for the Memory Forensics of the V8 Ja Engine

DFRWS EU 2022

Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing

Memory forensic analysis of a programmable logic controller in industrial control systems

DFRWS USA 2021

Duck Hunt: Memory Forensics of USB Attack Platforms

Seance: Di of Tool-Breaking Changes in Forensically Important Binaries

Le Intel DCI for Memory Forensics

DFRWS EU 2021

One key to rule them all: Reco the master key from RAM to break Android's file-based encryption

DFRWS USA 2020

Hiding Process Memory Techniques

Memory Analysis of macOS Page Queues

Memory FORESHADOW: Memory FOREnSics of HArDware cryptOcurrency Wallets – A Tool and Framework

DFRWS EU 2020

BMCLeech: Introducing Stealthy Memory Forensics to BMC Tobias Latzo

Tampering Digital E is Hard: The Case of Main Memory Images

On Challenges in Trusted Executable Files in Memory Forensics

Datasets

Digital Corpora

NIST

The Art of Memory Forensics

MemLabs

Windows XP

Challenges

2022 Plugin Contest

2021 Plugin Contest

2020 Plugin Contest

2019 Plugin & Analysis Contests

2018 Plugin & Analysis Contests

2017 Plugin Contest

2016 Plugin Contest

2015 Plugin Contest

2014 Plugin Contest

2013 Plugin Contest

2005 DFRWS Forensic Challenge

Contributors

Thank you for your contribution!

We welcome any contribution to the extent that Code of Conduct and the License comply.

<a href="
<img src=" />
</a>

项目信息

开发语言：未知

Star 数：567

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A curated list of awesome Memory Forensics for DFIR展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。