简体中文 | English

Lovelymem V2

A desktop memory forensics workbench for Windows
Bringing MemProcFS, Volatility, MemNixFS, investigation views, and an AI forensics agent into one interface

Evolution · Core capabilities · Quick start · Toolchain configuration · Repository structure · Security boundaries · License

[!IMPORTANT] v2 is the primary branch for Lovelymem V2. Windows x64 users can download the standalone EXE from Releases. References to Linux support in this document mean analysis of Linux memory images; they do not mean that the desktop client is fully supported on Linux.

Project Overview

Lovelymem V2 is a desktop memory forensics application built with Rust, Tauri 2, and native TypeScript. It brings image loading, tool execution, structured result viewing, evidence search, timeline investigation, rule-based analysis, and report preparation into a single workspace, reducing the need to switch repeatedly between command-line tools, CSV files, and multiple viewers.

The project does not bundle third-party forensic engines in the repository. You can configure paths to tools you already have in Settings or, on Windows x64, download supported tools from their respective official sources with one click.

Display

Evolution from the Python Version to V2

Lovelymem V2 continues the forensic approach of the earlier LovelyMem Python, but it is more than a new interface: the runtime foundation, page organization, tool provisioning, and investigation workflow have all been rebuilt.

Core Capabilities

Standalone Forensic Tools

• High-performance string search
• EXIF metadata viewing and export
• Image extraction from memory images
• Image steganography, channel, and bit-plane analysis
• Multi-source Super Timeline
• Raw memory image visualization and entropy analysis
• Read-only SQLite viewer
• Chunked hex viewer for large files
• IOC extractor
• Forensic analysis of registry CSV data

Workflow Overview

flowchart LR
    A["Memory image / dump"] --> B{"Identify image type"}
    B -->|Windows| C["MemProcFS<br/>Volatility 2 / 3"]
    B -->|Linux| D["MemNixFS<br/>Volatility 2 / 3 Linux"]
    C --> E["Unified results workspace"]
    D --> E
    E --> F["Processes · Network · Files · Registry · EVTX"]
    E --> G["Search · Rules · Timeline · IOCs"]
    E --> H["AI forensics agent · Reports · Export"]

Quick Start

Requirements

• Windows 10/11 x64
• Git
• Node.js 20 or >=22, with npm (use a currently maintained LTS release where possible)
• The latest stable Rust toolchain; stable-x86_64-pc-windows-msvc is recommended
• Microsoft C++ Build Tools and the Windows SDK
• Microsoft Edge WebView2 Runtime

[!NOTE] This repository uses Rust 2024 edition. Rust compilation is not required if you only run the Vite pages, but the browser environment cannot access the full Tauri backend functionality.

Install and Run

# Clone only the v2 branch; replace this with the actual repository URL
git clone --branch v2 --single-branch <repository-url>
Set-Location <repository-directory>

# Install dependencies exactly as specified by package-lock.json
npm ci

# Start the complete desktop development environment
npm run tauri dev

To preview only the frontend:

npm run dev

By default, Vite listens on http://127.0.0.1:14222. You can override the host address with TAURI_DEV_HOST; port 14222 is fixed and strict port checking is enabled. Always run npm commands from the repository root. Do not start Vite directly from pages/.

Build and Check

# Type-check TypeScript and build the frontend into dist/
npm run build

# Build the Tauri release application
npm run tauri build

# Check and test the Rust backend
Set-Location src-tauri
cargo check
cargo test
cargo clippy

The current value of bundle.active is false. As a result, npm run tauri build primarily produces a release executable; it does not automatically generate MSI or NSIS installers.

Toolchain Configuration

Open Settings → Toolchain Configuration to detect existing local paths or download missing tools individually or in a batch. Managed tools are stored by default in:

%APPDATA%\lovelymem-v2\
├── settings.json
└── tools\
    ├── python3\
    ├── python2\
    ├── memprocfs\
    ├── volatility2\
    ├── volatility2_plugin\
    ├── volatility3\
    └── memnixfs\

The one-click downloader applies the following safeguards:

• Allows only HTTPS and built-in official sources, and validates the final URL after redirects
• Enforces SHA-256 verification after download and also checks file size when official metadata provides it
• Safely extracts archives in a staging directory, with limits on individual file size, total size, and file count
• Verifies tool entry points and basic functionality before promoting an installation to the final directory
• Restores an existing managed tool if installation fails, and automatically synchronizes paths for successfully installed tools
• Does not modify the system PATH or automatically install system drivers
• Requires network access to official Python, GitHub, and PyPI services during downloads

[!WARNING] Python 2 has reached end-of-life. Dokany 2 and WinFsp are system components that require additional privileges and are not installed automatically by the application. Before installing any third-party tool, review the confirmation dialog and the LICENSE / NOTICE files included in the upstream distribution.

Repository Structure

.
├── pages/                  # Vite multi-page HTML entry points
├── public/assets/          # Static frontend assets
├── resources/              # Application resources and example scripts
├── scripts/                # Project maintenance scripts
├── src/
│   ├── i18n/               # Chinese and English dictionaries and runtime translation
│   ├── modules/            # Workspace, viewers, settings, and feature modules
│   ├── showcase/           # Styles and interactions for the version-evolution showcase
│   ├── css/                # Global and component styles
│   └── main.ts             # Frontend orchestration entry point
├── src-tauri/
│   ├── src/                # Rust commands, forensic engine adapters, and system capabilities
│   ├── icons/              # Application icons
│   ├── Cargo.toml
│   └── tauri.conf.json
├── package.json
├── tsconfig.json
└── vite.config.ts          # Multi-page entries and development port 14222

Technology Stack

• Desktop framework: Tauri 2
• Backend: Rust and Tokio
• Frontend: TypeScript, Vite, and native DOM modules in a multi-page application
• Terminal and editor: xterm.js and Monaco Editor
• Data and forensics: Rust components for SQLite, EVTX, EXIF, YARA, PDB/PE parsing, and more

Data, Network, and Security Boundaries

• Memory image parsing, viewers, and the primary forensic workflows run locally.
• Toolchain downloads, symbol retrieval, and user-configured AI providers generate network requests.
• The AI agent may send prompts or selected evidence required to complete a task to a user-configured service. Before enabling it, confirm the service's data-processing policy and the scope of your authorization.
• User-configured AI API keys are currently written to %APPDATA%\lovelymem-v2\settings.json. Restrict access to this file, and do not upload or share it.
• Memory images, dump results, and logs may contain credentials, keys, personal information, and other sensitive data. Use controlled directories and securely dispose of exported results.
• Analyze only devices, images, and data that you own or are explicitly authorized to examine.

Troubleshooting

Set-Location src-tauri
cargo clean
cargo check

Project License

The Lovelymem V2 project code is licensed under the GNU Affero General Public License v3.0, with the SPDX identifier AGPL-3.0-only. When using, modifying, deploying, or redistributing this project, comply with the complete license terms.

Acknowledgements

We thank the following projects and their communities for providing the capabilities on which Lovelymem V2 builds:

• MemProcFS
• Volatility 2
• Volatility 3
• MemNixFS
• Tauri

For memory forensics, incident response, and security research in lawful, authorized contexts.