Linux Memory Forensics | mysimulator.uk

Memory Dump Analysis

ps-style listing — walks the kernel's linked list of tasks. A rootkit that unlinks its own entry (DKOM) is invisible here.

Scan progress

Hidden process

unknown

Processes listed

Net connections

Process list

Run a memory scan to populate.

Network connections

Run a memory scan to populate.

Bash history (unflushed, from process memory)

Recovered from a still-running bash process's in-memory command buffer — survives even after the attacker ran history -c on disk.

Run a memory scan to populate.

How it works

The grid represents a Linux RAM dump's address space, captured live before shutdown (rebooting a compromised host destroys volatile evidence). A scan sweeps from low to high addresses, revealing allocated memory pages.

Normal process list — reproduces ps / Volatility's pslist: walks the kernel's doubly-linked task list. A process unlinked from that list by a rootkit (DKOM) does not appear, even though its memory pages are still there.
Deep memory analysis — reproduces Volatility's psscan: scans raw memory for process-structure signatures instead of following pointers, so it finds unlinked/hidden processes the linked-list walk misses.
Network sockets and the bash command-history buffer are carved straight out of process memory, independent of what was written to disk — which is why cleared logs and deleted binaries don't erase the evidence.

RAM dump · idle

Unallocated page Process memory Allocated, unattributed Hidden process — identified

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.