jtsylve/LiME
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition. observed · 2026-08-28
Health v2 · maintenance only
81/100
- Activity 75
- Release rhythm 77
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-02. Adoption (stars, forks) is never an input.
- gap_med: 15
- age_days: 4362
- days_rel: 155
- days_push: 150
- n_releases_24m: 4
Adoption not part of the score
2028 stars · 368 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded
LiME (Linux Memory Extractor) is a loadable kernel module that acquires volatile memory from Linux and Android devices, writing captures to local disk or streaming them over TCP. It minimizes user-kernel space interaction to produce forensically sound memory dumps in raw, lime, or padded formats with optional hashing and compression.
Use cases
- acquire full RAM dump from a Linux system for forensic analysis
- capture volatile memory from an Android device
- stream memory acquisition over the network to a remote workstation
- hash memory captures for integrity verification during incident response
- collect forensically sound memory evidence with minimal system disturbance
When to choose
- you need full physical memory captures from Linux or Android for forensics
- you want network-based memory acquisition from a compromised host
- you need minimal footprint acquisition that preserves evidentiary integrity
When to avoid
- you need userland memory dumps or process-specific memory only
- you need a cross-platform memory acquisition tool for Windows or macOS
- you cannot load kernel modules on the target system
Facets
cli-tool · maturity active
security security operating-systems android-tools cli memory-forensics kernel-module volatile-memory incident-response android-forensics forensics linux android
1 source
- readme: https://github.com/jtsylve/LiME · fetched 2026-08-28 · e2b8518a97d7
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| jtsylve/LiME | main | 81 |
For agents
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem