AVML (Acquire Volatile Memory for Linux) Logo

AVML (Acquire Volatile Memory for Linux)

0
Free
Visit Website

A portable volatile memory acquisition tool for Linux. AVML is an X86_64 userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary. AVML can be used to acquire memory without knowing the target OS distribution or kernel a priori. No on-target compilation or fingerprinting is needed. Features: - Save recorded images to external locations via Azure Blob Store or HTTP PUT - Automatic Retry (in case of network connection issues) with exponential backoff for uploading to Azure Blob Store - Optional page level compression using Snappy - Uses LiME output format (when not using compression) Memory Sources: - /dev/crash - /proc/kcore - /dev/mem If the memory source is not specified on the commandline, AVML will iterate over the memory sources to find a functional source. NOTE: If the kernel feature kernel_lockdown is enabled, AVML will not be able to acquire memory. Tested Distributions: - Ubuntu: 12.04, 14.04, 16.04, 18.04, 18.10, 19.04, 19.10, 20.04, 21.04, 22.04 - Centos: 6.5, 6.6, 6.7, 6.8, 6.9, 6.10, 7.0, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.9 - RHEL: 6.7, 6.8, 6.9, 7.0, 7.2, 7.3, 7.4, 7.5, 7.7, 8.5, 9.0 - Debian: 8, 9, 10

FEATURES

ALTERNATIVES

Turbinia is an open-source framework for automating the running of common forensic processing tools to help with processing evidence in the Cloud.

A library to access FileVault Drive Encryption (FVDE) encrypted volumes on Mac OS X systems.

Forensic imaging program with full hash authentication and various acquisition options.

Autopsy is a GUI-based digital forensics platform for analyzing hard drives and smart phones, with a plug-in architecture for custom modules.

No More Ransom is a collaborative project to combat ransomware attacks by providing decryption tools and prevention advice.

Automated tool for parsing Windows registry hives and extracting valuable information for forensic analysis.

Open Source computer forensics platform with modular design for easy automation and scripting.

A Cross-Platform Forensic Framework for Google Chrome that allows investigation of history, downloads, bookmarks, cookies, and provides a full report.

PINNED