PAGES
← all tools
◆ Digital Forensics & Incident Response

LiME

v1.10.0 open-source

LiME is a Loadable Kernel Module for volatile memory acquisition from Linux and Linux-based devices, such as Android.

source ↗ website ↗ rss ↗ What is a cyber toolchain?

Summary

LiME is an open-source Loadable Kernel Module that acquires volatile memory from Linux and Android systems, and it costs nothing to use. It is run by loading the module with insmod and passing arguments such as output path, format, and optional hashing or compression, writing the capture to local disk or streaming it over the network via netcat or TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.. This makes it a tool for DFIRDFIRDigital forensics and incident response, investigating what happened during a security incident and containing it. The work includes preserving evidence, reconstructing activity and restoring systems. practitioners who need forensically sound memory captures from live Linux or Android devices rather than a general-purpose acquisition suite. It supports raw, padded, and LiME-specific output formats, with the raw mode recently renamed raw expert to discourage casual use. First committed in 2014 and still active, with 31 contributors and 24 commits in the past year.

LiME is a Loadable Kernel Module for volatile memory acquisition from Linux and Linux-based devices, such as Android.

How LiME helps

Can I capture this Linux system's RAM without disturbing what's already in memory?

LiME runs as a kernel module that minimizes interaction between user and kernel space during acquisition, so the capture disturbs less evidence than tools that acquire memory through a user-space process

Where should this memory dump go — local disk or another machine?

the same capture can be written to a local output file or streamed out over a network port, so a responder can pull evidence off a host with no free disk space by piping it to a listener instead

Will this capture load correctly into the forensics tool I already use?

choosing the padded or lime output format keeps each memory range's original physical address information intact, while the raw format concatenates ranges and loses that positioning, making later analysis in most forensic tools unreliable

Can I prove this memory image wasn't altered after acquisition?

turning on the digest option produces a sidecar file with a hash of the captured RAM, computed alongside the dump, at the cost of touching more memory during the process

Is this script still passing a valid format value after upgrading LiME?

the raw format value was renamed to "raw expert" to discourage casual use, so any workflow still specifying the old raw value needs updating or it will fail to match the new option

all 3 features, with the evidence for each →

Languages

Not documented

Features

3 capabilities

Built from LiME's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • LiME covers 1 of the 8 investigation and response capabilities we track.
Memory forensics 3 features Investigation and response since 2019
Volatile memory extraction via loadable kernel module shipped Acquires volatile memory from Linux and Android devices to disk or over a network using a loadable kernel module. 2 releases · 2 other sources · first seen Oct 2019

Shared capability: Memory forensics

release

  • Adds compress=1 parameter to the LiME insmod module for in-kernel zlib compression of memory dumps v1.9 · Oct 2019 · source · release history
  • Enables up to 4x speedup in memory acquisition by reducing transfer size v1.9 · Oct 2019 · source · release history

docs

  • Loadable kernel module for acquiring volatile memory from Linux and Android devices to disk or over a network.

example

  • Load the LiME module with compression enabled to speed up forensic memory acquisition. insmod lime.ko path=memdump.lime format=lime compress=1 v1.9 · Oct 2019 · source
Raw expert memory acquisition shipped Acquires raw memory data with explicit warnings and documentation to discourage use without understanding its technical implications. 2 releases · first seen Aug 2025

Shared capability: Memory forensics

release

  • Renames raw acquisition mode to raw expert and adds warnings to discourage use of this format without understanding its implications. v1.10.0 · Aug 2025 · source · release history
  • The raw mode format option is renamed to raw expert; any scripts or workflows passing the raw mode value verbatim may need to be updated. v1.10.0 · Aug 2025 · source · release history
Local file memory acquisition shipped Acquires memory directly to a local file on the host system. 2 other sources

Shared capability: Memory forensics

example

  • Acquire memory to a local file insmod ./lime-$(uname -r).ko "path=/tmp/ram.lime format=lime"
  • Acquire Android memory to SD card insmod /sdcard/lime.ko "path=/sdcard/ram.lime format=lime"

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for LiME, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail LiME puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

2 entries

  1. August 20251
  3. October 20191
    Show

    2 entries

    1. v1.10.0 Aug 6, 2025 · release notes

      LiME v1.10.0 renames raw mode to raw expert with added warnings to discourage casual use.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.10.0 https://github.com/504ensicsLabs/LiME.git
# already have the repo? check out this version:
$ git checkout v1.10.0
      • Renames raw acquisition mode to raw expert and adds warnings to discourage use of this format without understanding its implications.

      1 detail in Everything

      └──▷ BREAKING ON UPGRADE
      • !The raw mode format option is renamed to raw expert; any scripts or workflows passing the raw mode value verbatim may need to be updated.
    2. v1.9 Oct 19, 2019 · release notes

      Adds kernel-level zlib compression to memory captures via insmod compress=1

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.9 https://github.com/504ensicsLabs/LiME.git
# already have the repo? check out this version:
$ git checkout v1.9
      └──▷ TRY IT
      Load the LiME module with compression enabled to speed up forensic memory acquisition.
      $ insmod lime.ko path=memdump.lime format=lime compress=1
      • Adds compress=1 parameter to the LiME insmod module for in-kernel zlib compression of memory dumps
      • Enables up to 4x speedup in memory acquisition by reducing transfer size

      2 details in Everything

    Project health

    Issue, contributor and maintainer activity in 504ensicsLabs/LiME, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 3 −1 vs prior 12 months
    2. Maintainers 1 +1 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog not measured open issues today
    1. Issues opened / month not measured
    2. Open backlog not measured
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 2,038
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback