[Name]
Memprocfs

[Version]
v5.18

[Homepage]
The source code is at https://github.com/ufrisk/memprocfs

[Author / License ]
It is maintained by ufrisk under the AGPLv3 license

[Description]
From the repository:

MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system.

Easy trivial point and click memory analysis without the need for complicated commandline arguments! Access memory content and artifacts via files in a mounted virtual file system or via a feature rich application library to include in your own projects!

It allows for performing forensics on Windows memory dumps, including features like a FUSE view of the full host systems and a timeline of all events.

[Dependencies]
Debian dependencies for compilation: make gcc pkg-config libusb-1.0 libusb-1.0-0-dev libfuse2 libfuse-dev lz4 liblz4-dev

FUSE support is required to run it.

[Similar tools]
volatility, autopsy

[Activity]
Started 5 years ago, latest release a week ago

[How to install]

wget https://github.com/ufrisk/MemProcFS/releases/download/v5.18/MemProcFS_files_and_binaries_v5.18.1-linux_x64-20260730.tar.gz
mkdir memprocfs
tar -xvf -C memprocfs MemProcFS_files_and_binaries_v5.18.1-linux_x64-20260730.tar.gz
./memprocfs/memprocfs

[How to use]
From GitHub:

• mount the memory dump file as default M:
  memprocfs.exe -device c:\temp\win10x64-dump.raw
• mount the memory dump file as default M: with extra verbosity:
  memprocfs.exe -device c:\temp\win10x64-dump.raw -v
• mount the memory dump file as default M: and start forensics mode:
  memprocfs.exe -device c:\temp\win10x64-dump.raw -forensic 1
• mount the memory dump file as default M: and start forensics mode with a yara scan:
  memprocfs.exe -device c:\temp\win10x64-dump.raw -forensic 1 -forensic-yara-rules c:\yara\rules\windows_malware_index.yar
• mount the memory dump file as /home/pi/mnt/ on Linux:
  ./memprocfs -mount /home/pi/linux -device /dumps/win10x64-dump.raw
• mount the memory dump file as S:
  memprocfs.exe -mount s -device c:\temp\win10x64-dump.raw
• mount live target memory, in read-only mode, with WinPMEM driver:
  memprocfs.exe -device pmem
• mount live target memory, in read/write mode, with PCILeech FPGA memory acquisition device:
  memprocfs.exe -device fpga -memmap auto
• mount a memory dump with a corresponding page files:
  memprocfs.exe -device unknown-x64-dump.raw -pagefile0 pagefile.sys -pagefile1 swapfile.sys

[Packaged]
Not packaged for Debian yet.