---
id: 1295
title: "mquire: Linux memory forensics without external dependencies"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2026/02/25/mquire-linux-memory-forensics-without-external-dependencies/"
published_at: "2026-02-25 12:00"
tags: ["open-source", "incident-response", "linux", "memory-forensics", "kernel", "tool-release", "trail-of-bits", "btf", "digital-forensics"]
phying_url: "https://phying.com/item/1295"
lang: en
---

# mquire: Linux memory forensics without external dependencies

## Summary

Trail of Bits open-sourced mquire, which analyzes Linux memory dumps without external debug symbols by extracting BTF type information and symbol addresses directly from the dump itself.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2026-02-25 12:00
- **Original:** https://blog.trailofbits.com/2026/02/25/mquire-linux-memory-forensics-without-external-dependencies/
- **Phying News:** https://phying.com/item/1295