Velocidex / WinPmem

The multi-platform memory acquisition tool.
Apache License 2.0
694 stars 102 forks source link

Is there LinPmem for extracting volatile memory on Android operating systems? #21

Open dougcello opened 3 years ago

dougcello commented 3 years ago

Hi!

I would like to know if there is such a tool for extracting volatile memory from Android operating systems, due to the complexity of extraction with the LiME tool.

Best Regards!

ghost commented 3 years ago

Have you checked Microsoft's AVML tool?

dougcello commented 3 years ago

Have you checked Microsoft's AVML tool?

https://github.com/microsoft/avml

Tested Distributions Ubuntu: 12.04, 14.04, 16.04, 18.04, 18.10, 19.04, 19.10 Centos: 6.5, 6.6, 6.7, 6.8, 6.9, 6.10, 7.0, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6 RHEL: 6.7, 6.8, 6.9, 7.0, 7.2, 7.3, 7.4, 7.5, 8 Debian: 8, 9 Oracle Linux: 6.8, 6.9, 7.3, 7.4, 7.5, 7.6

If I've checked at Android systems... don't! Did you?

ghost commented 3 years ago

Have you checked Microsoft's AVML tool?

https://github.com/microsoft/avml

Tested Distributions Ubuntu: 12.04, 14.04, 16.04, 18.04, 18.10, 19.04, 19.10 Centos: 6.5, 6.6, 6.7, 6.8, 6.9, 6.10, 7.0, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6 RHEL: 6.7, 6.8, 6.9, 7.0, 7.2, 7.3, 7.4, 7.5, 8 Debian: 8, 9 Oracle Linux: 6.8, 6.9, 7.3, 7.4, 7.5, 7.6

If I've checked at Android systems... don't! Did you?

Android is Linux, and that tool works on Linux distros in general.

dougcello commented 3 years ago

Have you checked Microsoft's AVML tool?

https://github.com/microsoft/avml Tested Distributions Ubuntu: 12.04, 14.04, 16.04, 18.04, 18.10, 19.04, 19.10 Centos: 6.5, 6.6, 6.7, 6.8, 6.9, 6.10, 7.0, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6 RHEL: 6.7, 6.8, 6.9, 7.0, 7.2, 7.3, 7.4, 7.5, 8 Debian: 8, 9 Oracle Linux: 6.8, 6.9, 7.3, 7.4, 7.5, 7.6 If I've checked at Android systems... don't! Did you?

Android is Linux, and that tool works on Linux distros in general.

On how to use it, I question it.

From what I understand, I can only use shell if I download Termux. Do I need to install packages?

I have domain over ADB, but I use it in recovery mode. And if it is to turn off the device, it is useless. By reading on the website to use with Ubuntu for example, there is a need to install packages. But on Android how to work with this tool?