Area 06

Memory Forensics

Some evidence only ever exists in RAM: fileless payloads, injected code, live network state and unlinked processes. This area covers acquisition with LiME and AVML, building Volatility 3 symbol tables for the exact kernel, and the plugins that matter.

LiME
AVML
Volatility 3

Guides in this area

06 · Memory Forensics

Linux Memory Forensics with LiME, AVML and Volatility 3

Acquire Linux RAM with LiME or AVML, build Volatility 3 symbol tables with dwarf2json, and find hidden processes, rootkit modules and bash history in memory.

memory-forensicsvolatilitylime

Sep 28, 2026

Artifact cheat sheets

Where each artifact lives, what it proves, its timestamps and the tools to parse it.

Linux Memory Acquisition: LiME, AVML and /proc/kcoreCapturing Linux RAM with LiME or AVML: memory sources, output formats, lockdown limits and the Volatility 3 symbol tables needed to analyse the image.
Linux Crash Reports and Core Dumps: coredump, apportsystemd-coredump, Ubuntu apport, ABRT and kdump on Linux: where crash data lands and how it exposes failed exploits and unstable implants.
eBPF Programs and Pinned Maps: Linux Kernel ImplantsLoaded eBPF programs, pinned objects in /sys/fs/bpf and their loaders on disk: how eBPF rootkits and BPF backdoors hide on Linux and how to find them.

All areas