How to extract the memory of a Linux device

If you want to do some memory analyzing of devices that are working under Linux or based on Linux like Android, I suggest you LiME.

LiME for Linux Memory Extractor is a tool that allows to realize a complete capture of a device memory. It is ideal if you like to do some forensics.

The acquisition is done via the network interface or directly on a SD card support and the tool is loading its module in the kernel with the help of the insmod command. You will then be able to enter the parameters required for the extraction.

Here is an example that explains how to load the core of an Android smartphone with adb :

adb push lime.ko /sdcard/lime.ko
adb forward tcp:4444 tcp:4444
adb shell
insmod /sdcard/lime.ko "path=tcp:4444 format=lime"

Then, once it is done, you can enter this command to launch the capture of the random access memory :

nc localhost 4444 > ram.lime

And if you want to do a copy of the memory of a SD card rather than from the network, load the module like that :

insmod /sdcard/lime.ko "path=/sdcard/ram.lime format=lime"

More informations on Github : LiME ~ Linux Memory Extractor