---
# System prepended metadata

title: Volatile memory acquisition
tags: [forensics-tutorials]

---

---
tags: forensics-tutorials
---

# Volatile memory acquisition

:::info
**In this short demo you will:** 
- Ho to perform volatile memory acquisition
:::

Get the LiME (Linux Memory Extractor) source code from https://github.com/504ensicsLabs/LiME


Next step is to run LiME with the insmod command. This step will acquire a memory sample in LiME format and in this case I also told LiME to produce a hash of the acquired memory sample. As an example the memory capture is written to disk but in a real incident is should be written to a network share, removable media sent via the network. Finally, you can remove the module with rmmod.

```
~$/LiME/src$ sudo insmod ./lime-5.6.2-050602-generic.ko "path=/tmp/limeImage.mem format=raw timeout=0"
~$ sudo rmmod lime
```

Check the hash:

```
~$/LiME/src$ md5sum /tmp/limeImage.mem
```

Now you can use the `strings` command to print the strings of printable characters in your image file

```
cat limeImage.mem | strings 
```

You can also use the `grep` command to search for some word. For example:

```
cat limeImage.mem | strings | grep "some word"
```

or even (if you want to send the data to a file)


```
cat limeImage.mem | strings > dictionary.txt
```

Finally, you can analyse the files by using photorec as shown below:

```
photorec limeImage.mem
```
