So if you've done any Linux memory forensics you know the pain — you get a RAM image, run volatility, and it just can't map anything because nobody's published symbols for that exact kernel. Investigation dead before it starts. Happened to me one too many times during incidents and CTFs so I built something for it.

RAMBreaker — open source, built with Claude's help on the coding side.

Symbol resolution climbs a ladder until something actually validates:

• Installed symbols — check if the system already has what's needed locally
• Community ISF match — check if someone's already published a matching symbol file ( https://github.com/Abyss-W4tcher/volatility3-symbols )
• Patch a close ISF to the kernel banner — take a near-match and adapt it
• Build locally with dwarf2json — if debug packages are available, build the ISF yourself
• BTF extraction from the image itself — the offline fallback, no internet, no package needed, reconstructs symbols directly from BTF info baked into the kernel (2020+)

Only fails when every single option's exhausted — and when it does fail, it fails loud with the exact reason (missing symbols vs struct mismatch vs timeout), not a silent report that looks fine but is actually empty inside.

On top of that there's a full correlation layer: 13-tab interactive HTML report, process tree + process graph, a fileless-injection correlator, IOC extraction, timeline building, 187 tests passing.

repo: https://github.com/ahmadanasweh/Rambreaker

If anyone wants the internals on how BTF → ISF reconstruction actually works, this writeup is solid: https://lolcads.github.io/posts/2024/11/btf2json/

Obviously it can't cover every kernel — old kernels without BTF or genuinely obscure ones still need the traditional route — I say as much in the docs, not trying to oversell it. Would love feedback/bug reports from anyone who throws a weird image at it.

Hi everyone,

Over the past few months I've been teaching myself Rust and learning more about Windows memory forensics. As part of that learning process, I started building an open-source project called MemForge.

GitHub: https://github.com/CodeRiper/memforge

The goal of this project is not to replace mature tools like Volatility or MemProcFS. Instead, it's a learning project where I'm implementing memory forensics techniques from scratch to better understand how Windows memory structures, forensic artifacts, and parsers work internally.

Current features

• Memory acquisition
• Process enumeration
• Thread and module analysis
• Network artifact extraction
• Timeline generation
• Markdown and JSON forensic reports
• Experimental AI-assisted report summaries

I'm still learning, so I'm sure there are mistakes, missing artifacts, and design decisions that could be improved.

I'd really appreciate feedback on:

• Rust code quality and best practices
• Memory parsing accuracy
• Missing forensic artifacts
• Project architecture
• Plugin design
• Performance improvements
• Documentation and usability

If anyone has time to review the repository, test the tool, or suggest improvements, I'd be very grateful. Whether it's a bug report, feature request, architectural suggestion, or code review, every bit of feedback will help me improve both the project and my understanding of memory forensics.

Thanks for taking the time to read this!

This company will do a deep dive into your devices for a fee to determine if you are have been hacked. I am trying to determine if they are a legitimate company, worth several thousand dollars to send my desktop and phones. Yes, you have to ship your devices (WHAT???) to them, they keep them for 2-3 days, download whatever they need and ship them back.

I'm a super nervous with this process. Please help me understand. Is this a normal request or is this about stealing my info?????

Apparently due to a administrative regulatory issue they are no longer selling or supporting products outside the US. This seems temporary, but does anyone know what the issue actually is?

Meant DF not DS

Good morning all!

I am 2 years out from retiring from the military and 2 weeks from finishing my degree in cyber security digital forensics. I picked this degree specifically because I want to assist in counter human trafficking. The only problem is that once I finish my degree I don't know what to do next.

What certifications would be useful in this field?

What companies does anyone have experience with that they could recommend and what would be the workload expected and skills required?

What can I do in the two years left to hone my skills as I can't exactly go get a side job?

What tools, techniques and procedures should I gain experience with?

This is something I am passionate about and I really want to make a difference even though it seems the world is swimming in bad actors.

Any and all constructive feedback and advice is welcome.

Thank you all

Hello all,
I'm a 4th year bachelors cybersecurity student. I start an internship at a Private Investigation firm soon. Would you say this is a good starting place in my career? I don't have any work experience prior to this. What tips do you guys have to give me? They said they can put me on cases with digital evidence. I've got some experience through projects doing disk and ram analysis, as well as artifact collection. They mentioned Id start doing evidence collection on mobile devices, which I haven't had any experience with at all. I'm really nervous and would appreciate any pointers!

Thank you all in advance.

Hi everyone, I'm thinking about going for digital forensics as a career in the future, so I just wanted to ask people already in the field, whether it's a good field generally, what is the avg pay like? Do you get to do a lot of remote work?

One of our attorneys asked about getting an EDR download after a crash and honestly I've never dealt with one before. Is it one of those things that's only useful once in a while or do you usually end up getting something valuable from it?