MoonSols delivers high-end utilities
to respond to advanced cyber-security attacks
in unknown territories.


Our utilities helps investigators to gather evidences via a unique technology.


Support can be provided to enterprises.


A powerful toolkit containing multiple applications to collect or convert any kind of memory snapshots.



No matter the version or the plateform of your target. MoonSols will assist you during your process.


Simple command-line based utilities, executable from a remote system or from a USB key.


Optimizer to provide the better performances to investigators.

  • MoonSols Memory Toolkit is one of those indispensable toolsets I simply can’t live without; be sure to add
    it to your kit too.

  • As with the others, I have older copies that I use and they work just fine. DumpIt is still available at the MoonSols site and works great for 32 or 64bit, give it a shot.

  • There are several ways to capture memory from a Windows machine for analysis, but want an easy one? I mean a really easy one? Then look no further than MoonSols “DumpIt“.

  • I agree, Matthieu Suiche’s DumpIt tool is fantastic!

Pricing Plans

Choose our free plan to get a hang of things and then upgrade as needed.



Completely Free

  • Version 1.4
  • Fully Functional
  • 64-bits
  • Support
  • Updates
  • Windows 8 support
  • Unlimited licence
  • Compression support
  • Encoding support




  • Independent consultant
  • Version 2.0
  • Fully Functional
  • No maintenance releases
  • Limited Windows 8/8.1 support
  • Unlimited licence
  • Compression support
  • Encoding support

Custom build


On request

  • Source-code access for agencies
  • Enterprise Edition
  • Annual Level-1 support
  • Support & Updates
  • Perpetual license
  • Private Training Course

Pricing FAQ

What is MoonSols Windows Memory Toolkit ?

MoonSols Windows Memory Toolkit is a powerful toolkit containing all the utilities needed to perform any kind of memory acquisition or conversion during an incident response, or a forensic analysis for Windows desktops, servers or virtualized environment. The version 2.0 is a refresh and updated version of our software to reply to the evolving needs of our clients and assist them to deliver in a strategic and professional way.

Do you support Windows 8 ?

Yes, the version 2.0 does. For both memory acquisition and hibernation file decompression and conversion.

Do you also provide dedicated support, and services to assist us in advanced analysis ?

Yes, we do. We can provided tailored analysis services for your company and tailored plug-in development.

I’ve been using MWMT for a long time, but do you also deliver training courses?

Yes we do. More information can be found on our training page but we can also study your needs together and create an tailored incident response training course for you and your team.