Velocidex/WinPmem

Health v2 · maintenance only

Flags: prerelease_only

Adoption not part of the score

1034 stars · 151 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

WinPmem is an open-source Windows physical memory acquisition tool with a signed kernel driver and standalone imager executables. It dumps raw memory images using multiple independent reading methods that can bypass kernel-mode rootkits.

Use cases

• dump physical memory from a Windows machine for forensic analysis
• acquire a RAM image during incident response
• capture live memory even when rootkits are present
• write a raw memory image to a file from the command line
• read live physical memory from Python for analysis on the running system

When to choose

• you need a self-contained, dependency-free memory imager for Windows incident response
• you want open-source, signed memory acquisition supporting Win7-Win10 x86 and x64
• you need multiple acquisition methods to defeat anti-forensic rootkits

When to avoid

• you need AFF4-format images (the AFF4 imager is not yet updated)
• you need memory acquisition on Linux or macOS (use Linpmem or other tools)
• you need to acquire memory from systems newer than the supported Windows versions

Facets

cli-tool · maturity active

security security windows windows cli memory-acquisition incident-response digital-forensics memory-dump kernel-driver forensics

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Velocidex/WinPmem")