Linux Memory Acquisition with LiME

There are several memory acquisition tools available for Linux but using them doesn’t necessarily have to be difficult. In this article we will be looking into using LiME for a simple Linux memory acquisation.LiME stands for Loadable Kernel Module (LKM) enabling the acquisition of volatile memory from Linux and Linux-based devices, including Android.

LiME can be cloned from the following github repository:

GitHub — 504ensicsLabs/LiME: LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.

Cloning the GitHub repository:

Command used :

git clone https://github.com/504ensicsLabs/LiME.git

Before cloning the repo, ensure that the system is updated with the following command:

sudo apt-update

Checking the pre-requisites and kernel version :

Once you have cloned the repo, go to the desired location by using the below command:

cd [PATH TO LiME]

Once you are in the directory ensure to run the following commands :

Get Nived Sawant’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The below command will show you the kernel version for your endpoint:

uname -r

Once you have the kernel version for youe endpoint go to the src folder in the cloned folder by running the below commands:

cd /LiME/src

You can then list out the items under “src” by using the below command.

ls

We should be looking for .c files and makefile. After listing out the files run the below command :

make 

Once completed without error(s) you should be presented with the below screen :

now in your /src folder, you shall be presented with a .ko file (kernel object file) named after your endpoint’s kernel version as mentioned below:

Simple yet effective memory acquisition:

LiME uses the “insmod” command for loading the module.

Run the below command to acquire:

insmod ./lime-6.2.0-39-generic.ko "[path where you want to save it]/[name of your file].mem format=raw"

example : insmod ./lime-6.2.0-39-generic.ko "path=/home/testuser/Desktop/test1.mem format=raw"

If everything concludes as planned, you should be presented with a .mem file which can be easily analysed through volatility.

Conclusion:

As an avid learner in the field, I acknowledge that each day presents new challenges and opportunities for growth. You don’t have to have a substantial budget to delve into DFIR; instead, you can diligently gather information from the internet, learning gradually and taking it at your own pace. Remember, Rome wasn’t built in a day, so trust in your abilities, take it easy, and keep progressing step by step.

Your feedback and suggestions are always welcomed.

Thank you.