Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using Ubuntu 11.10, and wish to simply know whether I can dump all physical memory and swap, as due to some kernel restrictions, I can't dd /dev/mem, even as superuser. Is there any workaround or option to allow dd'ing /dev/mem or a dedicated tool made to do this correctly?

share|improve this question says that kmem is disabled, and /dev/mem restricted. – Ciro Santilli 巴拿馬文件 六四事件 法轮功 Apr 20 '15 at 9:26
up vote 6 down vote accepted

Use fmem

You used to be able to simply dd /dev/mem back in the day, but no longer for security reasons (since kernel 2.6, IIRC).

The alternative is to either build the kernel yourself wih the option to let root do that (will edit with name later, on phone now) OR better, use fmem, a kernel module which creates a /dev/fmem device pretty much meant for easy dumping.

fmem works great for me on 12.04. Just make sure you use the file included in the tarball to load the module; do not use insmod:

$ ./
----Memory areas: -----
reg00: base=0x000000000 (    0MB), size= 1024MB, count=1: write-back
reg01: base=0x0c8800000 ( 3208MB), size=    2MB, count=1: write-combining
!!! Don't forget add "count=" to dd !!!

$ ls /dev/f*
/dev/fb0  /dev/fd0  /dev/fmem  /dev/full  /dev/fuse

$ sudo dd if=/dev/fmem of=/tmp/fmem_dump.dd bs=1MB count=10
10+0 records in
10+0 records out
10000000 bytes (10 MB) copied, 0.0331212 s, 302 MB/s
share|improve this answer
Works like a charm. Do I need to run make again if I reboot? – hexafraction Jun 9 '12 at 13:32
No, only when you change kernels :) – izx Jun 9 '12 at 13:35

You probably can't dd your memory in modern kernels cause they've been reducing direct access, which is mostly used for dodgy things. The forensics wiki links a few tools that might be of interest, but there's nothing that's really been updated in the past few years. LiME seems updated though I haven't tested it yet.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.