DAMM
An open-source memory forensics tool built on Volatility for differential analysis and data reduction in malware investigations.
What is DAMM?
DAMM is an open-source memory forensics tool built on top of Volatility. It is designed to speed up malware investigations by providing differential analysis capabilities, data reduction, and codified expert knowledge. The tool allows analysts to compare memory snapshots, filter results, and store findings in SQLite databases for efficient triage.
Digital forensics analysts, incident responders, and security researchers who need to analyze memory dumps for malware activity and investigate system compromises.
Developers choose DAMM for its powerful differencing engine, which highlights changes between memory states, and its integrated filtering and warning system that reduces manual effort. It extends Volatility with practical features tailored for real-world malware investigations.
Overview
Differential Analysis of Malware in Memory
Use Cases
Best For
- Comparing memory snapshots before and after a malware infection
- Filtering and querying forensic data by process ID or string attributes
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
