How to Gather RAM data?

What is RAM?

RAM is a form of computer memory that can be read and changed in any order, typically used to store working data and machine code.It is volatile in nature and store all inputs and data from the system boot up.

Why Gather RAM data?

Volatile memory contains the following system artifacts which gets lost when the device is restarted or shut down. The following artifacts can be expected out of the volatile memory acquisition process:

The steps for acquisition are as follows:

Read RAM on top of linux system as follows by the help of LiME(Linux Memory Extractor):

Lime is a Loadable Kernel Module (LKM) which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimises its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.

Git Repo

>_ yum install kernel-devel kernel-headers git make elfutils-libelf-devel -y

>_ yum groupinstall “Development tools”

2. Clone LiME repo from git :

>_ git clone

after clone the lime repo go to src folder of LiME by the cmd :

>_ cd LiME/src

3.Now compile the LiMe for a specific kernel as loadable kernel object by make command :

>_ make

4. Run python to store data on RAM and verify it by acquisition :

5.Now insert the kernel object we will provide the path and the format as raw in which we save the image as by the help of insmod command :

>_ insmod lime-4.18.0–305.el8.x86_64.ko “path=/root/my_test/LiME/src/ram.mem format=raw”

Depending on the ram size and disk I/O speed it will take time to dump ram data.

6. Type below command to check if variable value resides in ram or not :

>_ cat ram.mem | strings | grep “x=5”

Just Like LiME in Linux based system There is also tool like FTK Imager for Windows. To Know about more click here.

Thank You………..



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store