06 · Memory Forensics
Linux Memory Forensics with LiME, AVML and Volatility 3
Acquire Linux RAM with LiME or AVML, build Volatility 3 symbol tables with dwarf2json, and find hidden processes, rootkit modules and bash history in memory.
memory-forensicsvolatilitylime