A Linux memory acquisition tool that creates ELF core dumps compatible with gdb, crash, and drgn for incident response.
DumpItForLinux is a memory acquisition tool for Linux systems that captures physical memory and saves it as an ELF core dump file. It solves the problem of obtaining memory images for forensic analysis and debugging in a format that works directly with standard Linux tools like gdb and crash. The tool prioritizes interoperability and uses efficient compression to make memory analysis scalable.
Digital forensics investigators, incident responders, and security engineers who need to capture and analyze Linux system memory during security incidents or debugging sessions.
Developers choose DumpItForLinux because it produces standard ELF core dumps that work immediately with existing debugging tools, eliminating format conversion steps. Its Rust implementation ensures memory safety, and its user-space operation avoids kernel module complexities while maintaining full system memory access.
Memory acquisition for Linux that makes sense.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Generates standard ELF core dump files that work directly with gdb, crash, and drgn without conversion, as emphasized in the README for seamless integration.
Uses the Zstandard algorithm to produce compact .tar.zst archives, reducing storage and transfer costs while maintaining fast performance.
Written in Rust, ensuring inherent memory safety which minimizes bugs and enhances reliability in forensic contexts.
Operates entirely in user-space via /proc/kcore, avoiding kernel compatibility issues and simplifying deployment compared to module-based tools.
Must run with root access to read /proc/kcore, which introduces security risks and limits use in environments with strict privilege separation.
Relies on the kernel's /proc interface, which may not capture all memory in compromised systems or be available in minimal Linux distributions, reducing forensic integrity.
Lacks native remote acquisition features; the README mentions future expansion, but currently requires manual steps like gcloud compute scp for remote recovery.