Legal Cyber Academy
ToolFreeCurrent

MemProcFS

Ulf Frisk · MemProcFS 5 · 2026

Access and status

Cost

Free

Free to read or download at source. No account, no purchase.

Status

Current

Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.

What it is

An open-source memory forensics tool that mounts a RAM image (or live memory) as a virtual file system, so processes, handles, registry, and network state appear as browsable files and directories rather than plugin output. It ships a Python and C API and a plugin ecosystem.

Who it is for, and when

MemProcFS suits examiners who want to explore a memory image interactively rather than run a plugin at a time, and it is genuinely fast on large dumps. It is a useful second opinion alongside Volatility: two independently written parsers agreeing on a finding is a much stronger position in a report than one tool's output. The file-system metaphor also makes it easy to hand a colleague a path rather than a command line.

What it does not cover

Like Volatility it analyses memory and does not acquire it. It is not a substitute for disk analysis, has a steeper setup cost on non-Windows hosts, and its output conventions are its own — you cannot assume a Volatility plugin name maps to a MemProcFS path.

Go to the source

Open at github.com (opens in a new tab)

https://github.com/ufrisk/MemProcFS/wiki

Details

Type
Tool
Written for
AdvancedAdvanced
Author
Ulf Frisk
Version verified
MemProcFS 5
Year
2026
Topics
memory-forensics, incident-response, windows, open-source, live-response
Checked at source

Related entries

  • Volatility 3

    Free

    An open-source memory analysis framework that parses RAM images into processes, network state, loaded modules, injected code, registry hives resident in memory, and command history. Volatility 3 is the actively developed line; Volatility 2 is legacy and should not be the basis of new work, though its documentation is still used for plugin comparison.

  • The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory

    Paid

    Memory acquisition and analysis across Windows, Linux and macOS, written by the people who built Volatility: process and kernel structures, code injection, rootkit detection, registry and event logs recovered from RAM, the GUI subsystem, network state, and case studies.

  • KAPE (Kroll Artifact Parser and Extractor)

    Partly free

    A Kroll-owned Windows triage tool that collects forensically relevant files from a live or mounted system using configurable Targets, then runs parsers over what it collected using Modules. It bypasses file locks with raw disk reads and preserves original timestamps on the copies.

  • SIFT Workstation

    Free

    A free Ubuntu LTS-based virtual machine appliance from SANS that bundles more than a hundred open-source incident response and forensic tools, pre-configured and dependency-resolved. It is still actively updated by Rob Lee and a small team and underpins several SANS DFIR courses.

  • Sigma

    Free

    An open, structured YAML format for describing detections in log data, plus a community rule repository and the pySigma/sigma-cli tooling that converts a rule into the query language of a particular SIEM or log platform. The rule repository is actively released by SigmaHQ.