LiMEaide – Remotely Dump Linux RAM

LiMEaide is a python application designed to remotely dump RAM of a Linux client and create a volatility profile for later analysis on your local host. I hope that this will simplify Linux digital forensics in a remote environment. In order to use LiMEaide all you need to do is feed a remote Linux client IP address, sit back, and consume your favorite caffeinated beverage.

Well how does it work?

1. Make a remote connection with specified client over SHH
2. Transfer necessary build files to the remote machine
3. Build the memory scrapping Loadable Kernel Module (LKM) LiME
4. LKM will dump RAM
5. Transfer RAM dump and RAM maps back to host
6. Build a Volatility profile

Download