MemForensics

Advanced Memory Forensic Toolkit
A comprehensive, cross-platform memory forensics analysis platform with PyQt6 GUI. Integrates active memory acquisition, deleted file recovery, unallocated space scanning, process analysis, and malware detection.
github.com/xosski/MemForensics
Features
1. Active Memory Dump
Full Memory Acquisition: Dump entire physical RAM
Windows: Using WinPmem driver or Win32 API fallback
Linux: Using /proc/kcore, /dev/mem, or dd
Process Memory Dump: Extract specific process memory space
Progress Tracking: Real-time dump progress with statistics
Admin Detection: Verifies required privileges before attempting dump
2. Memory Dump Analysis
Chunk-based analysis of memory dumps (1MB regions)
Shannon entropy calculation (detects obfuscation/encryption)
String extraction:
ASCII strings (printable characters)
Unicode strings (UTF-16)
Hash generation: MD5, SHA256 for quick identification
Code injection detection
Shellcode pattern matching
API hook detection
3. File Carving
Recovers deleted images and videos from disk:

Supported Formats:
Images: JPEG, PNG, GIF, BMP, TIFF
Videos: MP4, AVI, MOV, MKV, WebM
Documents: PDF, ZIP, RAR
Recovery Methods:
Header-based carving
Footer validation for enhanced accuracy
Confidence scoring
Entropy-based validation
Batch Recovery: Recover multiple files to output directory
4. Unallocated Space Scanner
Forensic artifact detection from unallocated disk space:

File Headers: Detects deleted file signatures
Text Artifacts:
URLs and email addresses
File paths (Windows and Linux)
Database Records:
SQLite databases
Windows Registry hives
Event logs
Memory Structures: Dumped heap and stack data
Sector-Based Scanning: Scan specific disk ranges
5. Live Process Analysis
Real-time process enumeration
Detailed process information:
Memory usage (RSS, VMS, etc.)
Open file handles
Network connections
Thread count
Child processes
Suspicious process detection
Process relationship mapping
6. Signature Scanning
Malware pattern detection:

Shellcode identification
DLL injection patterns
API call hooks
Network communication signatures
Registry persistence patterns
Code cave detection
Embedded executable detection
7. System Health Monitoring
CPU usage and core count
Memory statistics
Disk usage metrics
Active process monitoring
System Requirements
Windows
Windows 7 or later
Administrator privileges (for memory dumping)
Python 3.8+
Optional: WinPmem driver for improved memory acquisition
Linux
Linux kernel 3.0+
Root privileges (for memory/device access)
Python 3.8+
Tools: dd, file, openssl