Learning Android Forensics - Second Edition

Imaging RAM with LiME

The most common tool for Android RAM acquisition is the Linux Memory Extractor (LiME), previously known as DMD. LiME is free and open source, but isn't highly user-friendly as it requires the user to compile it from the source code, which can only be done on a Linux system. The compilation process must also be done for each specific version of Android for each device being examined, which somewhat limits its usability in the field. This is necessary because LiME is not binary (like the netcat and nanddump tools we used before); instead, it is a kernel module, which must be built specifically for each kernel it will be loaded into.

In order to ensure that the proper kernel source code is downloaded, we will need to determine ...