LiME is a Linux kernel module (LKM) for volatile memory acquisition from Linux and Android systems, widely used in digital forensics and incident response. It dumps physical memory ranges marked as "System RAM" by walking the kernel's iomem resource tree, writing output to a local file or streaming over a TCP connection. The module supports three output formats (raw, padded, and lime with metadata headers), optional zlib compression, optional cryptographic digest sidecar files (leveraging the kernel's crypto API), and direct I/O. It minimizes interaction with user space during capture to produce more forensically sound images. The architecture is a classic kernel module with clearly separated concerns: main.c drives the iomem traversal and orchestrates output via vtable-like structures; tcp.c and disk.c provide network and file-system transport; hash.c wraps three generations of kernel crypto APIs (ahash, hash, tfm) for portable digest support; and deflate.c wraps zlib with balanced memory settings. The codebase is aggressively version-aware, supporting kernels from 2.6.11 through 6.19 with conditionally compiled code paths for API breakpoints (e.g., set_fs removal, kmap_local_page, sock_set_reuseaddr). The project ships an exceptionally thorough CI/CD pipeline (GitHub Actions) that compiles against eight pinned kernel series and a canary latest-kernel build, runs sparse static analysis and custom grep-based source checks, and boots real kernels in QEMU to perform runtime smoke tests of all output formats, digest, and compression. A self-contained local testing harness (Docker) enables developers to reproduce the full CI matrix offline. Configuration management, kernel tree caching, and version pinning are handled by well-documented scripts that are themselves reusable for other kernel module projects.
androidqf is a Go-based Android forensic data acquisition tool designed to collect various types of data from an Android device via ADB. The tool automates the gathering of device properties, system logs, running processes, services, settings, diagnostic information, installed applications (with optional APK extraction), and device backups. It stores the collected data in a timestamped directory and optionally encrypts and compresses the archive using age encryption if a public key is provided. The application follows a modular architecture where each data collection task is implemented as a separate module adhering to a common interface. The core components include a cross-platform ADB wrapper that automatically deploys platform-specific binaries, an asset embedding mechanism for distributing native dependencies, and an acquisition manager that handles the lifecycle of data collection and secure storage. The tool interacts with the device through ADB commands, collects data into structured files and directories, and provides user prompts for configurable options such as backup scope and APK selection. Despite the README indicating the project is not maintained, the repository shows recent commit activity and the codebase demonstrates solid engineering practices. Dependencies are up to date, and the tool is built for cross-platform use (Windows, macOS, Linux) with automated build and release workflows. The modular design allows for extensibility, and the reusable components (such as the ADB wrapper and asset deployment) could be adapted for other projects requiring Android device interaction.