MemProcFS
Memory forensics framework that mounts physical memory dumps and live memory as a virtual file system.
Technical Architecture & Overview
MemProcFS presents memory images and live machine memory as a mounted file system, so analysts browse processes, handles, registry hives, and event logs with normal file tools. It includes a forensic mode with the FindEvil module, which flags indicators such as code injection, plus YARA scanning and an API with C/C++, Rust, and Python plugin support. Release notes list support for Windows 11 24H2.
Targeted Technical Use Cases
Exploring a memory capture from an incident without learning a separate command syntax.
Evaluation & Trade-offs
Core Strengths
- +File-system view makes memory analysis accessible with standard tools.
- +FindEvil flags code injection and other malware indicators for triage.
- +Supports acquisition devices as well as raw dumps.
Trade-Offs & Limitations
- -FindEvil detects only user-mode malware, has false positives, and is primarily available on 64-bit Windows 10 and 11.
- -Mounting requires a file system library on the analysis host: Dokany on Windows, FUSE on Linux, or macFUSE on macOS.
Defensive Security Application
Memory triage during incident response to find signs of code injection and rootkit behavior.
Frequently Asked Questions
What is MemProcFS?→
MemProcFS presents memory images and live machine memory as a mounted file system, so analysts browse processes, handles, registry hives, and event logs with normal file tools. It includes a forensic mode with the FindEvil module, which flags indicators such as code injection, plus YARA scanning and an API with C/C++, Rust, and Python plugin support. Release notes list support for Windows 11 24H2.
What is MemProcFS used for?→
Exploring a memory capture from an incident without learning a separate command syntax.
What are the strengths of MemProcFS?→
- +File-system view makes memory analysis accessible with standard tools.
- +FindEvil flags code injection and other malware indicators for triage.
- +Supports acquisition devices as well as raw dumps.
What are the limitations of MemProcFS?→
- +FindEvil detects only user-mode malware, has false positives, and is primarily available on 64-bit Windows 10 and 11.
- +Mounting requires a file system library on the analysis host: Dokany on Windows, FUSE on Linux, or macFUSE on macOS.
How is MemProcFS used defensively?→
Memory triage during incident response to find signs of code injection and rootkit behavior.