{"id":12858,"date":"2021-05-14T21:59:03","date_gmt":"2021-05-14T16:29:03","guid":{"rendered":"https:\/\/kalilinuxtutorials.com\/?p=12858"},"modified":"2021-05-14T21:59:03","modified_gmt":"2021-05-14T16:29:03","slug":"winpmem","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/winpmem\/","title":{"rendered":"WinPmem : The Multi-Platform Memory Acquisition Tool"},"content":{"rendered":"\n<p>WinPmem has been the default open source memory acquisition driver for windows for a long time. It used to live in the Rekall project, but has recently been separated into its own repository.<\/p>\n\n\n\n<p class=\"has-light-green-cyan-background-color has-background\"><strong>Description<\/strong><\/p>\n\n\n\n<p>WinPmem is a physical memory acquisition tool with the following features:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Open source<\/li><li>Support for WinXP &#8211; Win 10, x86 + x64. The WDK7600 can be used to include WinXP support. As default, the provided WinPmem executables will be compiled with WDK10, supporting Win7 &#8211; Win10, and featuring more modern code.<\/li><li>Three different independent methods to create a memory dump. One method should always work even when faced with kernel mode rootkits.<\/li><li>Raw memory dump image support.<\/li><li>A read device interface is used instead of writing the image from the kernel like some other imagers. This allows us to have complex userspace imager (e.g. copy across network, hash etc), as well as run analysis on the live system (e.g. can be run directly on the device).<\/li><\/ul>\n\n\n\n<p>The files in this directory (Including the WinPmem sources and signed binaries), are available under the following license: Apache License, Version 2.0.<\/p>\n\n\n\n<p class=\"has-light-green-cyan-background-color has-background\"><strong>How to use<\/strong><\/p>\n\n\n\n<p>There are two WinPmem executables: winpmem_mini_x86.exe and winpmem_mini_x64.exe. Both versions contain both drivers (32 and 64 bit versions).<\/p>\n\n\n\n<p>The mini in the binary name refers to this imager being a plain simple imager &#8211; it can only produce images in RAW format. In the past we release a WinPmem imager based on AFF4 but that one is yet to be updated to the new driver. Please let us know if you need the AFF4 based imager.<\/p>\n\n\n\n<p class=\"has-light-green-cyan-background-color has-background\"><strong>The Python acquisition tool winpmem.py<\/strong><\/p>\n\n\n\n<p>The python program is currently under construction but works as a demonstration for how one can use the imager from Python.<\/p>\n\n\n\n<p class=\"has-light-green-cyan-background-color has-background\"><strong>winpmem_mini_x64.exe (standalone executable)<\/strong><\/p>\n\n\n\n<p>This program is easiest to use for incident response since it requires no other dependencies than the executable itself. The program will load the correct driver (32 bit or 64 bit) automatically and is self-contained.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">Examples:<\/h5>\n\n\n\n<p class=\"has-vivid-green-cyan-color has-black-background-color has-text-color has-background\"><strong>winpmem_mini_x64.exe physmem.raw<\/strong><\/p>\n\n\n\n<p>Writes a raw image to physmem.raw using the default method of acquisition.<\/p>\n\n\n\n<p class=\"has-vivid-green-cyan-color has-black-background-color has-text-color has-background\"><strong>winpmem_mini_x64.exe<\/strong><\/p>\n\n\n\n<p>Invokes the usage print \/ short manual.<\/p>\n\n\n\n<p>To acquire a raw image using specifically the MmMapIoSpace method:<\/p>\n\n\n\n<p class=\"has-vivid-green-cyan-color has-black-background-color has-text-color has-background\"><strong>winpmem.exe -1 myimage.raw<\/strong><\/p>\n\n\n\n<p>The driver will be automatically unloaded after the image is acquired!<\/p>\n\n\n\n<p class=\"has-text-align-center has-vivid-green-cyan-background-color has-background\"><strong>Experimental write support<\/strong><\/p>\n\n\n\n<p>The WinPmem source code supports writing to memory as well as reading. This capability is a great learning tool since many rootkit hiding techniques can be emulated by writing to memory directly.<\/p>\n\n\n\n<p>This functionality should be used with extreme caution!<\/p>\n\n\n\n<p>NOTE: Since this is a rather dangerous capability, the signed binary drivers have write support disabled. You can rebuild the drivers to produce test signed binaries if you want to use this feature. The unsigned binaries (really self signed with a test certificate) can not load on a regular system due to them being test self signed, but you can allow the unsigned drivers to be loaded on a test system by issuing (see&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/windows-hardware\/drivers\/install\/the-testsigning-boot-configuration-option\">https:\/\/docs.microsoft.com\/en-us\/windows-hardware\/drivers\/install\/the-testsigning-boot-configuration-option<\/a>:<\/p>\n\n\n\n<p class=\"has-vivid-green-cyan-color has-black-background-color has-text-color has-background\"><strong>Bcdedit.exe -set TESTSIGNING ON<\/strong><\/p>\n\n\n\n<p>and reboot. You will see a small &#8220;Test Mode&#8221; text on the desktop to remind you that this machine is configured for test signed drivers.<\/p>\n\n\n\n<p>Additionally, Write support must also be enabled at load time:<\/p>\n\n\n\n<p class=\"has-vivid-green-cyan-color has-black-background-color has-text-color has-background\"><strong>winpmem.exe -w -l<\/strong><\/p>\n\n\n\n<p>This will load the drivers and turn on write support.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button is-style-outline is-style-outline--1\"><a class=\"wp-block-button__link has-vivid-cyan-blue-background-color has-background\" href=\"https:\/\/github.com\/Velocidex\/WinPmem#description\"><strong>Download<\/strong><\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>WinPmem has been the default open source memory acquisition driver for windows for a long time. It used to live in the Rekall project, but has recently been separated into its own repository. Description WinPmem is a physical memory acquisition tool with the following features: Open source Support for WinXP &#8211; Win 10, x86 + [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":16808,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/1.bp.blogspot.com\/-qoRF1iHjkKw\/YJoauk7XU2I\/AAAAAAAAJDo\/DkCkSwIBKHg5cdasWy5bt09V3Hj1Mjd5gCLcBGAsYHQ\/s728\/1%2B%25281%2529.png","fifu_image_alt":"WinPmem : The Multi-Platform Memory Acquisition Tool","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[28],"tags":[2676,3743],"class_list":["post-12858","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kali","tag-python","tag-winpmem"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>WinPmem : The Multi-Platform Memory Acquisition Tool<\/title>\n<meta name=\"description\" content=\"WinPmem has been the default open source memory acquisition driver for windows for a long time. It used to live in the Rekall project.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kalilinuxtutorials.com\/winpmem\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WinPmem : The Multi-Platform Memory Acquisition Tool\" \/>\n<meta property=\"og:description\" content=\"WinPmem has been the default open source memory acquisition driver for windows for a long time. It used to live in the Rekall project.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kalilinuxtutorials.com\/winpmem\/\" \/>\n<meta property=\"og:site_name\" content=\"Kali Linux Tutorials\" \/>\n<meta property=\"article:published_time\" content=\"2021-05-14T16:29:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/1.bp.blogspot.com\/-qoRF1iHjkKw\/YJoauk7XU2I\/AAAAAAAAJDo\/DkCkSwIBKHg5cdasWy5bt09V3Hj1Mjd5gCLcBGAsYHQ\/s728\/1%2B%25281%2529.png\" \/>\n<meta name=\"author\" content=\"R K\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/1.bp.blogspot.com\/-qoRF1iHjkKw\/YJoauk7XU2I\/AAAAAAAAJDo\/DkCkSwIBKHg5cdasWy5bt09V3Hj1Mjd5gCLcBGAsYHQ\/s728\/1%2B%25281%2529.png\" \/>\n<meta name=\"twitter:creator\" content=\"@CyberEdition\" \/>\n<meta name=\"twitter:site\" content=\"@CyberEdition\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"R K\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/winpmem\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/winpmem\/\"},\"author\":{\"name\":\"R K\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad\"},\"headline\":\"WinPmem : The Multi-Platform Memory Acquisition Tool\",\"datePublished\":\"2021-05-14T16:29:03+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/winpmem\/\"},\"wordCount\":574,\"publisher\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/winpmem\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/1.bp.blogspot.com\/-qoRF1iHjkKw\/YJoauk7XU2I\/AAAAAAAAJDo\/DkCkSwIBKHg5cdasWy5bt09V3Hj1Mjd5gCLcBGAsYHQ\/s728\/1%2B%25281%2529.png\",\"keywords\":[\"Python\",\"WinPmem\"],\"articleSection\":[\"Kali Linux\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/winpmem\/\",\"url\":\"https:\/\/kalilinuxtutorials.com\/winpmem\/\",\"name\":\"WinPmem : The Multi-Platform Memory Acquisition Tool\",\"isPartOf\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/winpmem\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/winpmem\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/1.bp.blogspot.com\/-qoRF1iHjkKw\/YJoauk7XU2I\/AAAAAAAAJDo\/DkCkSwIBKHg5cdasWy5bt09V3Hj1Mjd5gCLcBGAsYHQ\/s728\/1%2B%25281%2529.png\",\"datePublished\":\"2021-05-14T16:29:03+00:00\",\"description\":\"WinPmem has been the default open source memory acquisition driver for windows for a long time. It used to live in the Rekall project.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/kalilinuxtutorials.com\/winpmem\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/winpmem\/#primaryimage\",\"url\":\"https:\/\/1.bp.blogspot.com\/-qoRF1iHjkKw\/YJoauk7XU2I\/AAAAAAAAJDo\/DkCkSwIBKHg5cdasWy5bt09V3Hj1Mjd5gCLcBGAsYHQ\/s728\/1%2B%25281%2529.png\",\"contentUrl\":\"https:\/\/1.bp.blogspot.com\/-qoRF1iHjkKw\/YJoauk7XU2I\/AAAAAAAAJDo\/DkCkSwIBKHg5cdasWy5bt09V3Hj1Mjd5gCLcBGAsYHQ\/s728\/1%2B%25281%2529.png\"},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#website\",\"url\":\"https:\/\/kalilinuxtutorials.com\/\",\"name\":\"Kali Linux Tutorials\",\"description\":\"Kali Linux Tutorials\",\"publisher\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/kalilinuxtutorials.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#organization\",\"name\":\"Kali Linux Tutorials\",\"url\":\"https:\/\/kalilinuxtutorials.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png\",\"contentUrl\":\"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png\",\"width\":272,\"height\":90,\"caption\":\"Kali Linux Tutorials\"},\"image\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/CyberEdition\",\"https:\/\/www.threads.com\/@cybersecurityedition\",\"https:\/\/www.linkedin.com\/company\/cyberedition\",\"https:\/\/www.instagram.com\/cybersecurityedition\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad\",\"name\":\"R K\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g\",\"caption\":\"R K\"},\"url\":\"https:\/\/kalilinuxtutorials.com\/author\/ranjith\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"WinPmem : The Multi-Platform Memory Acquisition Tool","description":"WinPmem has been the default open source memory acquisition driver for windows for a long time. It used to live in the Rekall project.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kalilinuxtutorials.com\/winpmem\/","og_locale":"en_US","og_type":"article","og_title":"WinPmem : The Multi-Platform Memory Acquisition Tool","og_description":"WinPmem has been the default open source memory acquisition driver for windows for a long time. It used to live in the Rekall project.","og_url":"https:\/\/kalilinuxtutorials.com\/winpmem\/","og_site_name":"Kali Linux Tutorials","article_published_time":"2021-05-14T16:29:03+00:00","og_image":[{"url":"https:\/\/1.bp.blogspot.com\/-qoRF1iHjkKw\/YJoauk7XU2I\/AAAAAAAAJDo\/DkCkSwIBKHg5cdasWy5bt09V3Hj1Mjd5gCLcBGAsYHQ\/s728\/1%2B%25281%2529.png","type":"","width":"","height":""}],"author":"R K","twitter_card":"summary_large_image","twitter_image":"https:\/\/1.bp.blogspot.com\/-qoRF1iHjkKw\/YJoauk7XU2I\/AAAAAAAAJDo\/DkCkSwIBKHg5cdasWy5bt09V3Hj1Mjd5gCLcBGAsYHQ\/s728\/1%2B%25281%2529.png","twitter_creator":"@CyberEdition","twitter_site":"@CyberEdition","twitter_misc":{"Written by":"R K","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/kalilinuxtutorials.com\/winpmem\/#article","isPartOf":{"@id":"https:\/\/kalilinuxtutorials.com\/winpmem\/"},"author":{"name":"R K","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad"},"headline":"WinPmem : The Multi-Platform Memory Acquisition Tool","datePublished":"2021-05-14T16:29:03+00:00","mainEntityOfPage":{"@id":"https:\/\/kalilinuxtutorials.com\/winpmem\/"},"wordCount":574,"publisher":{"@id":"https:\/\/kalilinuxtutorials.com\/#organization"},"image":{"@id":"https:\/\/kalilinuxtutorials.com\/winpmem\/#primaryimage"},"thumbnailUrl":"https:\/\/1.bp.blogspot.com\/-qoRF1iHjkKw\/YJoauk7XU2I\/AAAAAAAAJDo\/DkCkSwIBKHg5cdasWy5bt09V3Hj1Mjd5gCLcBGAsYHQ\/s728\/1%2B%25281%2529.png","keywords":["Python","WinPmem"],"articleSection":["Kali Linux"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/kalilinuxtutorials.com\/winpmem\/","url":"https:\/\/kalilinuxtutorials.com\/winpmem\/","name":"WinPmem : The Multi-Platform Memory Acquisition Tool","isPartOf":{"@id":"https:\/\/kalilinuxtutorials.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/kalilinuxtutorials.com\/winpmem\/#primaryimage"},"image":{"@id":"https:\/\/kalilinuxtutorials.com\/winpmem\/#primaryimage"},"thumbnailUrl":"https:\/\/1.bp.blogspot.com\/-qoRF1iHjkKw\/YJoauk7XU2I\/AAAAAAAAJDo\/DkCkSwIBKHg5cdasWy5bt09V3Hj1Mjd5gCLcBGAsYHQ\/s728\/1%2B%25281%2529.png","datePublished":"2021-05-14T16:29:03+00:00","description":"WinPmem has been the default open source memory acquisition driver for windows for a long time. It used to live in the Rekall project.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kalilinuxtutorials.com\/winpmem\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kalilinuxtutorials.com\/winpmem\/#primaryimage","url":"https:\/\/1.bp.blogspot.com\/-qoRF1iHjkKw\/YJoauk7XU2I\/AAAAAAAAJDo\/DkCkSwIBKHg5cdasWy5bt09V3Hj1Mjd5gCLcBGAsYHQ\/s728\/1%2B%25281%2529.png","contentUrl":"https:\/\/1.bp.blogspot.com\/-qoRF1iHjkKw\/YJoauk7XU2I\/AAAAAAAAJDo\/DkCkSwIBKHg5cdasWy5bt09V3Hj1Mjd5gCLcBGAsYHQ\/s728\/1%2B%25281%2529.png"},{"@type":"WebSite","@id":"https:\/\/kalilinuxtutorials.com\/#website","url":"https:\/\/kalilinuxtutorials.com\/","name":"Kali Linux Tutorials","description":"Kali Linux Tutorials","publisher":{"@id":"https:\/\/kalilinuxtutorials.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kalilinuxtutorials.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/kalilinuxtutorials.com\/#organization","name":"Kali Linux Tutorials","url":"https:\/\/kalilinuxtutorials.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/","url":"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png","contentUrl":"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png","width":272,"height":90,"caption":"Kali Linux Tutorials"},"image":{"@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/CyberEdition","https:\/\/www.threads.com\/@cybersecurityedition","https:\/\/www.linkedin.com\/company\/cyberedition","https:\/\/www.instagram.com\/cybersecurityedition\/"]},{"@type":"Person","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad","name":"R K","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g","caption":"R K"},"url":"https:\/\/kalilinuxtutorials.com\/author\/ranjith\/"}]}},"jetpack_featured_media_url":"https:\/\/1.bp.blogspot.com\/-qoRF1iHjkKw\/YJoauk7XU2I\/AAAAAAAAJDo\/DkCkSwIBKHg5cdasWy5bt09V3Hj1Mjd5gCLcBGAsYHQ\/s728\/1%2B%25281%2529.png","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":27618,"url":"https:\/\/kalilinuxtutorials.com\/collect-memorydump\/","url_meta":{"origin":12858,"position":0},"title":"Collect-MemoryDump : Automated Creation Of Windows Memory Snapshots For DFIR","author":"R K","date":"November 16, 2022","format":false,"excerpt":"Collect-MemoryDump is automated Creation of Windows Memory Snapshots for DFIR. Collect-MemoryDump.ps1 is PowerShell script utilized to collect a Memory Snapshot from a live Windows system (in a forensically sound manner). Features Checks for Hostname and Physical Memory Size before starting memory acquisition Checks if you have enough free disk space\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEipvqO5Dtm5LdRHTLqK-Ni90fg8uXfdEp29GRIrv7V7Vt0kWTC1cvY8DP5He7ZPb4N26UIMnd9VUuSLXqda9Hwfbd4N8f69xmoLgMwjVjiVkLIB2Nm_OnMmFoD9jba-1z20gCqjk5pLAwNC-cJ7XQEca1r5TkmzNc-IdQRuC-V2_hrHC1Vd7PUQMVlA\/s728\/Collect-MemoryDump1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEipvqO5Dtm5LdRHTLqK-Ni90fg8uXfdEp29GRIrv7V7Vt0kWTC1cvY8DP5He7ZPb4N26UIMnd9VUuSLXqda9Hwfbd4N8f69xmoLgMwjVjiVkLIB2Nm_OnMmFoD9jba-1z20gCqjk5pLAwNC-cJ7XQEca1r5TkmzNc-IdQRuC-V2_hrHC1Vd7PUQMVlA\/s728\/Collect-MemoryDump1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEipvqO5Dtm5LdRHTLqK-Ni90fg8uXfdEp29GRIrv7V7Vt0kWTC1cvY8DP5He7ZPb4N26UIMnd9VUuSLXqda9Hwfbd4N8f69xmoLgMwjVjiVkLIB2Nm_OnMmFoD9jba-1z20gCqjk5pLAwNC-cJ7XQEca1r5TkmzNc-IdQRuC-V2_hrHC1Vd7PUQMVlA\/s728\/Collect-MemoryDump1.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEipvqO5Dtm5LdRHTLqK-Ni90fg8uXfdEp29GRIrv7V7Vt0kWTC1cvY8DP5He7ZPb4N26UIMnd9VUuSLXqda9Hwfbd4N8f69xmoLgMwjVjiVkLIB2Nm_OnMmFoD9jba-1z20gCqjk5pLAwNC-cJ7XQEca1r5TkmzNc-IdQRuC-V2_hrHC1Vd7PUQMVlA\/s728\/Collect-MemoryDump1.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":6694,"url":"https:\/\/kalilinuxtutorials.com\/memprocfs-the-memory-process-file-system\/","url_meta":{"origin":12858,"position":1},"title":"MemProcFS : The Memory Process File System","author":"R K","date":"September 30, 2019","format":false,"excerpt":"MemProcFS the Memory Process File System is an easy and convenient way of accessing physical memory as files a virtual file system. Easy trivial point and click memory analysis without the need for complicated commandline arguments! Access memory content and artifacts via files in a mounted virtual file system or\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/img.youtube.com\/vi\/Da_9SV9FA34\/0.jpg?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":15477,"url":"https:\/\/kalilinuxtutorials.com\/csirt-collect\/","url_meta":{"origin":12858,"position":2},"title":"CSIRT-Collect : PowerShell Script To Collect Memory And (Triage) Disk Forensics","author":"R K","date":"August 31, 2021","format":false,"excerpt":"CSIRT-Collect is a PowerShell script to collect memory and (triage) disk forensics for incident response investigations. The script leverages a network share, from which it will access and copy the required executables and subsequently upload the acquired evidence to the same share post-collection. Permission requirements for said directory will be\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/1.bp.blogspot.com\/-liQxT_Vh6_E\/YSclQkyhZ5I\/AAAAAAAAKko\/zB-T2m3rHp4MF5eFDaOhPhSH81BKse6VgCLcBGAsYHQ\/s728\/Disk%2BForensics.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/1.bp.blogspot.com\/-liQxT_Vh6_E\/YSclQkyhZ5I\/AAAAAAAAKko\/zB-T2m3rHp4MF5eFDaOhPhSH81BKse6VgCLcBGAsYHQ\/s728\/Disk%2BForensics.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/1.bp.blogspot.com\/-liQxT_Vh6_E\/YSclQkyhZ5I\/AAAAAAAAKko\/zB-T2m3rHp4MF5eFDaOhPhSH81BKse6VgCLcBGAsYHQ\/s728\/Disk%2BForensics.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/1.bp.blogspot.com\/-liQxT_Vh6_E\/YSclQkyhZ5I\/AAAAAAAAKko\/zB-T2m3rHp4MF5eFDaOhPhSH81BKse6VgCLcBGAsYHQ\/s728\/Disk%2BForensics.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":17449,"url":"https:\/\/kalilinuxtutorials.com\/csirt-collect-2\/","url_meta":{"origin":12858,"position":3},"title":"CSIRT-Collect : PowerShell Script To Collect Memory And (Triage) Disk Forensics","author":"R K","date":"August 6, 2021","format":false,"excerpt":"CSIRT-Collect is a PowerShell script to collect memory and (triage) disk forensics for incident response investigations. The script leverages a network share, from which it will access and copy the required executables and subsequently upload the acquired evidence to the same share post-collection. Permission requirements for said directory will be\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":24549,"url":"https:\/\/kalilinuxtutorials.com\/live-forensicator\/","url_meta":{"origin":12858,"position":4},"title":"Live-Forensicator : Powershell Script To Aid Incidence Response And Live Forensics","author":"R K","date":"May 24, 2022","format":false,"excerpt":"Live Forensicator is part of the Black Widow Toolbox, its aim is to assist Forensic Investigators and Incidence responders in carrying out a quick live forensic investigation. It achieves this by gathering different system information for further review for anomalous behaviour or unexpected data entry, it also looks out for\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEibJZg_AxQpa6cBxCeCTxZ3U8PXgrnag7fyTzew2m9ZfxBGq6WHghQXP14kSGY1Mkwc5RzxkCxZJtiz9bKVWqOmxqjIP9j6JHN_a8axWminXdVri3XEJjCr0__a4hrqHAR3_64QTQEhUKo2dp_6oawNWITraTeXN7W3Nr2kr848T0o5P4mtqdEu0pR2\/s728\/68747470733a2f2f6a6f686e2e6e672f77702d636f6e74656e742f75706c6f6164732f323032322f30342f48544d4c2d564945572d464f52454e53494341544f522e706e67%20%281%29.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEibJZg_AxQpa6cBxCeCTxZ3U8PXgrnag7fyTzew2m9ZfxBGq6WHghQXP14kSGY1Mkwc5RzxkCxZJtiz9bKVWqOmxqjIP9j6JHN_a8axWminXdVri3XEJjCr0__a4hrqHAR3_64QTQEhUKo2dp_6oawNWITraTeXN7W3Nr2kr848T0o5P4mtqdEu0pR2\/s728\/68747470733a2f2f6a6f686e2e6e672f77702d636f6e74656e742f75706c6f6164732f323032322f30342f48544d4c2d564945572d464f52454e53494341544f522e706e67%20%281%29.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEibJZg_AxQpa6cBxCeCTxZ3U8PXgrnag7fyTzew2m9ZfxBGq6WHghQXP14kSGY1Mkwc5RzxkCxZJtiz9bKVWqOmxqjIP9j6JHN_a8axWminXdVri3XEJjCr0__a4hrqHAR3_64QTQEhUKo2dp_6oawNWITraTeXN7W3Nr2kr848T0o5P4mtqdEu0pR2\/s728\/68747470733a2f2f6a6f686e2e6e672f77702d636f6e74656e742f75706c6f6164732f323032322f30342f48544d4c2d564945572d464f52454e53494341544f522e706e67%20%281%29.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEibJZg_AxQpa6cBxCeCTxZ3U8PXgrnag7fyTzew2m9ZfxBGq6WHghQXP14kSGY1Mkwc5RzxkCxZJtiz9bKVWqOmxqjIP9j6JHN_a8axWminXdVri3XEJjCr0__a4hrqHAR3_64QTQEhUKo2dp_6oawNWITraTeXN7W3Nr2kr848T0o5P4mtqdEu0pR2\/s728\/68747470733a2f2f6a6f686e2e6e672f77702d636f6e74656e742f75706c6f6164732f323032322f30342f48544d4c2d564945572d464f52454e53494341544f522e706e67%20%281%29.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":33824,"url":"https:\/\/kalilinuxtutorials.com\/kdrill\/","url_meta":{"origin":12858,"position":5},"title":"Kdrill &#8211; Unveiling Rootkit Intrusions In Windows 64-Bit Systems","author":"Varshini","date":"July 15, 2024","format":false,"excerpt":"Kdrill is a tool to analyze the kernel land of Windows 64b systems (tested from Windows 7 to Windows 11). Its main objective is to assess if the kernel is compromised by a rootkit. The code is compatible with python2\/3 without dependencies and can perfom checks without Microsoft symbols or\u2026","rel":"","context":"In &quot;Cyber security&quot;","block_context":{"text":"Cyber security","link":"https:\/\/kalilinuxtutorials.com\/category\/cyber-security\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh0tzp44UfeUBWJoj0tMqImEqjsJitlLPOoyK0RRUa96JI2uT562fzCCaIBgUdZzThKJB7rgBPjsrrBnRrxohdy6NPujLUvMYMENN9SW2UEVInZWNmisj8IxOCJu7GgNyNksrYtJgM9A-BjD6RTLXgiwnOpc-LqfK5xvTd6xPZCGr_XZFaGJ1zNQ2K7Dl1C\/s16000\/Kdrill%20.webp?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh0tzp44UfeUBWJoj0tMqImEqjsJitlLPOoyK0RRUa96JI2uT562fzCCaIBgUdZzThKJB7rgBPjsrrBnRrxohdy6NPujLUvMYMENN9SW2UEVInZWNmisj8IxOCJu7GgNyNksrYtJgM9A-BjD6RTLXgiwnOpc-LqfK5xvTd6xPZCGr_XZFaGJ1zNQ2K7Dl1C\/s16000\/Kdrill%20.webp?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh0tzp44UfeUBWJoj0tMqImEqjsJitlLPOoyK0RRUa96JI2uT562fzCCaIBgUdZzThKJB7rgBPjsrrBnRrxohdy6NPujLUvMYMENN9SW2UEVInZWNmisj8IxOCJu7GgNyNksrYtJgM9A-BjD6RTLXgiwnOpc-LqfK5xvTd6xPZCGr_XZFaGJ1zNQ2K7Dl1C\/s16000\/Kdrill%20.webp?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh0tzp44UfeUBWJoj0tMqImEqjsJitlLPOoyK0RRUa96JI2uT562fzCCaIBgUdZzThKJB7rgBPjsrrBnRrxohdy6NPujLUvMYMENN9SW2UEVInZWNmisj8IxOCJu7GgNyNksrYtJgM9A-BjD6RTLXgiwnOpc-LqfK5xvTd6xPZCGr_XZFaGJ1zNQ2K7Dl1C\/s16000\/Kdrill%20.webp?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh0tzp44UfeUBWJoj0tMqImEqjsJitlLPOoyK0RRUa96JI2uT562fzCCaIBgUdZzThKJB7rgBPjsrrBnRrxohdy6NPujLUvMYMENN9SW2UEVInZWNmisj8IxOCJu7GgNyNksrYtJgM9A-BjD6RTLXgiwnOpc-LqfK5xvTd6xPZCGr_XZFaGJ1zNQ2K7Dl1C\/s16000\/Kdrill%20.webp?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh0tzp44UfeUBWJoj0tMqImEqjsJitlLPOoyK0RRUa96JI2uT562fzCCaIBgUdZzThKJB7rgBPjsrrBnRrxohdy6NPujLUvMYMENN9SW2UEVInZWNmisj8IxOCJu7GgNyNksrYtJgM9A-BjD6RTLXgiwnOpc-LqfK5xvTd6xPZCGr_XZFaGJ1zNQ2K7Dl1C\/s16000\/Kdrill%20.webp?resize=1400%2C800&ssl=1 4x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/posts\/12858","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/comments?post=12858"}],"version-history":[{"count":0,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/posts\/12858\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/media\/16808"}],"wp:attachment":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/media?parent=12858"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/categories?post=12858"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/tags?post=12858"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}