Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How would one create a dump of the physical memory (RAM) in Linux?

What software if any is available for this purpose?

I have read that one should not write to a local disk but rather send the data over the network. Anyone know the peculiarities here? Would Ethernet work for this purpose, or are there any commands which minimize the amount of caching before sending to disk?

WinHex on Windows has such functionality:

enter image description here

I am looking for something similar on Linux.

share|improve this question
add comment

3 Answers

Here is a eHow page on How to Dump Linux Memory

Linux provides two virtual devices for this purpose, '/dev/mem' and '/dev/kmem', though many distributions disable them by default for security reasons. '/dev/mem' is linked to the physical system memory, whereas '/dev/kmem' maps to the entire virtual memory space, including any swap. Both devices work as regular files, and can be used with dd or any other file manipulation tool.

That leads to the ForensicsWiki page on Memory Imaging Tools with the Linux/Unix section,

  1. dd On Unix systems, the program dd can be used to capture the contents of physical memory using a device file (e.g. /dev/mem and /dev/kmem). In recent Linux kernels, /dev/kmem is no longer available. In even more recent kernels, /dev/mem has additional restrictions. And in the most recent, /dev/mem is no longer available by default, either. Throughout the 2.6 kernel series the trend has been to reduce direct access to memory via pseudo-device files. See, for example, the message accompanying this patch: http://lwn.net/Articles/267427/. On Red Hat systems (and derived distros such as CentOS), the crash driver can be loaded to create a pseudo-device for memory access ("modprobe crash").
  2. Second Look This commercial memory analysis product has the ability to acquire memory from Linux systems, either locally or from a remote target via DMA or over the network. It comes with pre-compiled Physical Memory Access Driver (PMAD) modules for hundreds of kernels from the most commonly used Linux distributions.
  3. Idetect (Linux)
  4. fmem (Linux)
    fmem is kernel module, that creates device /dev/fmem, similar to /dev/mem but without limitations. This device (physical RAM) can be copied using dd or other tool. Works on 2.6 Linux kernels. Under GNU GPL.
  5. Goldfish
    Goldfish is a Mac OS X live forensic tool for use only by law enforcement. Its main purpose is to provide an easy to use interface to dump the system RAM of a target machine via a Firewire connection. It then automatically extracts the current user login password and any open AOL Instant Messenger conversation fragments that may be available. Law Enforcement may contact goldfish.ae for download information.

See Also: Linux Memory Analysis.
There is also GDB commonly available on most Linuxes.
And, you are always advised to avoid writing over unknown memory -- it can lead to system corruption.

share|improve this answer
    
Has anyone tried this on a recent Ubuntu system? –  user44053 Feb 6 '11 at 4:18
    
no /dev/mem or /dev/kmem on my debian system. –  Rob May 1 '12 at 19:13
add comment

Second Look is a good, easy way to dump memory in Linux: http://secondlookforensics.com/.

There also is a recently released kernel module you could try called LiME: http://code.google.com/p/lime-forensics/

share|improve this answer
add comment

Volatility seems to be working well and is Windows and Linux compatible.

From their website:

Volatility supports memory dumps from all major 32- and 64-bit Windows versions and service packs including XP, 2003 Server, Vista, Server 2008, Server 2008 R2, and Seven. Whether your memory dump is in raw format, a Microsoft crash dump, hibernation file, or virtual machine snapshot, Volatility is able to work with it. We also now support Linux memory dumps in raw or LiME format and include 35+ plugins for analyzing 32- and 64-bit Linux kernels from 2.6.11 - 3.5.x and distributions such as Debian, Ubuntu, OpenSuSE, Fedora, CentOS, and Mandrake. We support 38 versions of Mac OSX memory dumps from 10.5 to 10.8.3 Mountain Lion, both 32- and 64-bit. Android phones with ARM processors are also supported.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.