WindowsSCOPE
Memory forensics and reverse engineering tool used for analyzing volatile memory offering the capability of analyzing the Windows kernel, drivers, DLLs, and virtual and physical memory.
- from
- Incident Response
- added
- 2026-10-10
- likes
- 0
similar
-
procscope github.com
Process-scoped runtime investigator using eBPF to trace process lifecycle, file activity, and network connections.
-
OSForensics osforensics.com
Tool to acquire live memory on 32-bit and 64-bit systems. A dump of an individual process’s memory space or physical memory dump can be done.
-
Memoryze fireeye.com
Free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the paging file in its analysis.
-
PeriScope github.com
(2019) - A probing and fuzzing framework that tests device drivers at the hardware-OS boundary through MMIO and DMA inputs.
-
Rekall rekall-forensic.com
Open source tool (and library) for the extraction of digital artifacts from volatile memory (RAM) samples.
-
Incident Response › IR Tools Collection > Memory Analysis Tools: “Memory forensics and reverse engineering tool used for analyzing volatile memory offering the capability of analyzing the Windows kernel, drivers, DLLs, and virtual and physical memory.”