A portable volatile memory acquisition tool for Linux that captures memory images without requiring target OS or kernel knowledge.
AVML is a volatile memory acquisition tool specifically designed for Linux systems that captures memory images for forensic analysis. It solves the problem of acquiring memory from diverse Linux distributions and kernel versions without requiring prior knowledge of the target environment or on-target compilation. The tool provides a portable static binary that can capture memory from multiple sources and optionally upload directly to cloud storage.
Digital forensic investigators, incident response teams, security researchers, and malware analysts who need to capture volatile memory from Linux systems during security investigations.
Developers choose AVML because it provides a reliable, zero-dependency memory acquisition solution that works across numerous Linux distributions without requiring kernel modules or complex setup. Its cloud upload capabilities and LiME format compatibility make it particularly valuable for modern forensic workflows.
AVML - Acquire Volatile Memory for Linux
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Written in Rust and compiled as a static binary with no dependencies, eliminating the need for on-target compilation or fingerprinting across tested distributions like Ubuntu and RHEL.
Iterates over /dev/crash, /proc/kcore, and /dev/mem to find a functional memory source automatically, reducing manual configuration errors in forensic acquisitions.
Supports direct upload to Azure Blob Store, AWS S3, and GCP Cloud Storage via HTTP PUT with automatic retry and exponential backoff, streamlining evidence collection in cloud environments.
Outputs in the standard LiME format when uncompressed, ensuring seamless integration with established forensic tools like Volatility for memory analysis.
Fails entirely if the kernel_lockdown feature is enabled, a common restriction in modern secure boot setups, limiting its use on hardened systems without workarounds.
Only supports x86_64 Linux systems, excluding ARM-based servers or IoT devices that are increasingly relevant in forensic investigations.
Requires local disk space for temporary storage during acquisition, which can be problematic on systems with limited storage or in diskless environments, despite compression options.