LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.

GNU General Public License v2.0

LiME

Forensic tool for acquisition, triage and analysis of remote block devices via iSCSI protocol.

GNU Lesser General Public License v3.0

SPECTR3

A tool to help forensicate offline docker acquisitions

Apache License 2.0

docker-explorer

Support for ROS-enabled RGBD data acquisition in Unreal Engine Projects

ROSIntegrationVision

Data acquisition for Raspberry Pi and Micropython

Other

meerkat

Provides situational awareness of Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) networks in support of network security assessments. #nsacyber

GRASSMARLIN

Windows Live Artifacts Acquisition Script

AChoir

MIT License

margaritashotgun

:lock: acmetool, an automatic certificate acquisition tool for ACME (Let's Encrypt)

acmetool

🚨 The artifactcollector is a customizable agent to collect forensic artifacts on any Windows, macOS or Linux system