Simplify Linux digital forensics!
In order to use LiMEaide all you need to do is feed a remote Linux client IP address, sit back, and consume your favorite caffeinated beverage.
How does it work?
- Make a remote connection with specified client over SHH
- Transfer necessary build files to the remote machine
- Build the memory scrapping Loadable Kernel Module (LKM) LiME
- LKM will dump RAM
- Transfer RAM dump and RAM maps back to host
- Build a Volatility profile
In order to use LiMEaide you need to resolve some dependencies.
sudo apt-get install python3-paramiko python3-termcolor
sudo apt-get install dwarfdump
- Download LiME v1.7.8
- Extract into
- Rename folder to