{"adoption": {"forks": 151, "observed_at": "2026-08-28T04:03:18.652281+00:00", "stars": 1034}, "canonical_url": "https://ross.abutalabs.com/products/winpmem", "card": {"archived": false, "artifact_type": "cli-tool", "description": "The multi-platform memory acquisition tool.", "domain": ["security", "windows"], "enriched": true, "function": ["security"], "health_score": 58, "homepage": null, "language": "C", "license": "Apache-2.0", "license_family": "permissive", "maturity": "active", "member_repos": ["Velocidex/WinPmem"], "name": "Velocidex/WinPmem", "platform": ["windows", "cli"], "pushed_at": "2025-10-14T14:13:22+00:00", "repo": "Velocidex/WinPmem", "stars": 1034, "tags": ["memory-acquisition", "incident-response", "digital-forensics", "memory-dump", "kernel-driver", "forensics"], "topics": [], "urls": [], "use_cases": ["dump physical memory from a Windows machine for forensic analysis", "acquire a RAM image during incident response", "capture live memory even when rootkits are present", "write a raw memory image to a file from the command line", "read live physical memory from Python for analysis on the running system"], "what_it_is": "WinPmem is an open-source Windows physical memory acquisition tool with a signed kernel driver and standalone imager executables. It dumps raw memory images using multiple independent reading methods that can bypass kernel-mode rootkits.", "when_to_avoid": ["you need AFF4-format images (the AFF4 imager is not yet updated)", "you need memory acquisition on Linux or macOS (use Linpmem or other tools)", "you need to acquire memory from systems newer than the supported Windows versions"], "when_to_choose": ["you need a self-contained, dependency-free memory imager for Windows incident response", "you want open-source, signed memory acquisition supporting Win7-Win10 x86 and x64", "you need multiple acquisition methods to defeat anti-forensic rootkits"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/winpmem", "repo": "Velocidex/WinPmem", "role": "main", "score": 44}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:03:18.652281+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T07:06:31.064175+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bc8399d350a36540e026cc702543c987917721ebaa7a876b5df8056efd3148c3", "fetched_at": "2026-08-28T04:03:18.652281+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Velocidex/WinPmem"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:03:18.652281+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T07:06:31.064175+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bc8399d350a36540e026cc702543c987917721ebaa7a876b5df8056efd3148c3", "fetched_at": "2026-08-28T04:03:18.652281+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Velocidex/WinPmem"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T07:06:31.064175+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bc8399d350a36540e026cc702543c987917721ebaa7a876b5df8056efd3148c3", "fetched_at": "2026-08-28T04:03:18.652281+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Velocidex/WinPmem"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:03:18.652281+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:03:18.652281+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:03:18.652281+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T07:06:31.064175+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bc8399d350a36540e026cc702543c987917721ebaa7a876b5df8056efd3148c3", "fetched_at": "2026-08-28T04:03:18.652281+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Velocidex/WinPmem"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:03:18.652281+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:03:18.652281+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T07:06:31.064175+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bc8399d350a36540e026cc702543c987917721ebaa7a876b5df8056efd3148c3", "fetched_at": "2026-08-28T04:03:18.652281+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Velocidex/WinPmem"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:03:18.652281+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:03:18.652281+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:03:18.652281+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T07:06:31.064175+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bc8399d350a36540e026cc702543c987917721ebaa7a876b5df8056efd3148c3", "fetched_at": "2026-08-28T04:03:18.652281+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Velocidex/WinPmem"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:03:18.652281+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:03:18.652281+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T07:06:31.064175+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bc8399d350a36540e026cc702543c987917721ebaa7a876b5df8056efd3148c3", "fetched_at": "2026-08-28T04:03:18.652281+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Velocidex/WinPmem"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T07:06:31.064175+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bc8399d350a36540e026cc702543c987917721ebaa7a876b5df8056efd3148c3", "fetched_at": "2026-08-28T04:03:18.652281+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Velocidex/WinPmem"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T07:06:31.064175+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bc8399d350a36540e026cc702543c987917721ebaa7a876b5df8056efd3148c3", "fetched_at": "2026-08-28T04:03:18.652281+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Velocidex/WinPmem"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T07:06:31.064175+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bc8399d350a36540e026cc702543c987917721ebaa7a876b5df8056efd3148c3", "fetched_at": "2026-08-28T04:03:18.652281+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Velocidex/WinPmem"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 47, "longevity": 100, "rhythm": 8}, "computed_at": "2026-09-03T02:39:23.370411+00:00", "flags": ["prerelease_only"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 2665, "days_push": 323, "days_rel": 649, "gap_med": null, "n_releases_24m": 1}, "score": 44, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}