Lethe Forensics

Lethe is a lightweight memory forensics prototype for Linux RAM dumps. It is designed as a smaller, explainable complement to heavyweight frameworks: it scans raw dumps for high-signal process, network, and module artifacts, scores anomalies, and emits an Orin-compatible evidence bundle.

This first cut is profile-free. It does not try to replace kernel-symbol-aware object walking yet; every extracted artifact includes byte offsets and confidence so the output stays reviewable.

Usage

python3 -m lethe_mem scan memory.raw --case-id CASE-001 --output evidence.json

The bundle contains:

• processes: process-like command lines, systemd service paths, and kernel comm-style hints.
• network_connections: Linux /proc/net/tcp* style rows and URL/socket-like strings found in RAM.
• modules: .ko paths, module basenames, and Linux vermagic strings.
• anomalies: rule-based findings that are structured so a future local LLM/small model can replace or augment the scorer.

Roadmap

• Add LiME and AVML metadata parsing.
• Add optional Linux profile/symbol support for real task_struct, tcp_sock, and module walking.
• Add Windows scanners for EPROCESS, DRIVER_OBJECT, PE headers, and pool tags.
• Replace the rule scorer with a local embedding/model adapter trained on labeled memory artifact bundles.