LiME Memory Image
| Format | LiME Memory Image |
|---|---|
| Short name | LiME |
| Category | memory |
| Platforms | Linux, Android |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Physical memory captured from Linux and Android devices with the LiME kernel module; Microsoft's AVML also writes this format. In 'lime' format each captured memory range is preceded by a 32-byte header with magic, version and its start and end physical address; gaps between ranges are not stored. 'padded' format fills gaps with zeros, 'raw' format concatenates the ranges without headers, losing the physical address information. AVML can additionally write a Snappy-compressed variant with 'AVML' range headers.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 45 4D 69 4C | EMiL | Range header magic 0x4C694D45 (little-endian 'EMiL') |
| offset 0 (0x0) | 41 56 4D 4C | AVML | AVML compressed range header magic 0x4C4D5641 (little-endian 'AVML', version 2) |
Known extensions
.lime
References
- LiME — Linux Memory Extractor https://github.com/jtsylve/LiME
- AVML — Acquire Volatile Memory for Linux (Microsoft) https://github.com/microsoft/avml
Cite this entry
Crush Format Reference, “LiME Memory Image”. https://kalink0.github.io/crush-forensics/formats/lime/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction