Memory Forensics with LiMe

Installing LiMe on a Kali Linux UTM virtual machine on an M1 Mac.

In your Kali Linux Virtual Machine, enter the following on the command line:

$ sudo nano /etc/apt/sources.list

Uncomment the deb-src line.

$ sudo apt update -y
$ sudo apt upgrade -y
$ sudo apt dist-upgrade

Reboot the Kali virtual machine.

$ sudo apt-get install linux-headers-$(uname -r)
$ git clone https://github.com/504ensicsLabs/LiME.git
$ cd LiME/src/
$ make
$ sudo insmod ./lime-6.1.0-kali5-arm64.ko “path=../../kali-arm64.mem format=lime”
$ sudo rmmod lime

Your memory image is now the file kali-arm64.mem, wherever you installed lime.

This entry was posted in Uncategorized. Bookmark the permalink.

Leave a Reply