Comae Toolkit !new! -
If you are an MSSP handling 50 alerts a day, or a corporate IR team that needs to answer "Is this machine compromised?" in under 5 minutes, Comae is your tool. It turns memory forensics from a "post-mortem autopsy" into a "live patient triage."
April 13, 2026 Author: DFIR Lab Staff
The Comae Dumper solves this using a technique reminiscent of the "SnapShot" approach from the old Windows Hibernation file analysis. It minimizes kernel interaction. In our stress tests, the Comae Dumper completed a full 32GB RAM capture in with zero perceptible lag on the host system. For Incident Response (IR), that is the difference between catching the adversary and alerting them. Raw Speed: Analysis Without the Wait Volatility is powerful, but it is slow. Running windows.pslist.PsList on a large profile can take minutes. The Comae Toolkit, however, leverages a highly optimized JSON-based output and a "streaming" architecture. comae toolkit
If you are still manually dumping RAM with winpmem and waiting ten minutes for a profile to load, it is time to look at what the Comae ecosystem offers. The Comae Toolkit is a suite of memory acquisition and analysis tools designed around a simple philosophy: Speed, Stability, and Accessibility. Unlike traditional monolithic frameworks, Comae focuses on doing one thing extremely well—snapshotting Windows memory states and analyzing them via a cloud-based or local API. If you are an MSSP handling 50 alerts
For years, the digital forensics community has relied on a handful of heavy hitters. When it comes to memory analysis, Volatility has been the gold standard. But if you have been following the work of Matthieu Suiche (the founder of Comae Technologies), you know that a leaner, meaner, and incredibly fast alternative has been gaining serious traction: . In our stress tests, the Comae Dumper completed
