Amele is a desktop forensic acquisition tool for authorized investigations. It brings disk imaging, memory acquisition, Android collection, iOS backup normalization, Docker container DFIR, hash verification, case output handling, image viewing, and reporting into one native application.

Local & Remote Disk Acquisition: Create raw disk images from local disks or image files with RAW or AFF4 output formatting. Collect disk images through the Amele Linux and Windows agents or agentless SSH/WinRM streaming with live throughput and hashing.

Memory (RAM) Acquisition: Capture volatile RAM with AVML on Linux and WinPMEM on Windows, plus remote memory dumps via Agent or Agentless SSH streaming (/proc/kcore, AVML, WinPMEM).

Mobile Forensics (Android & iOS): Verify ADB status, list devices, collect logical/filesystem/volatile data on Android. Normalize iTunes/Finder backups on iOS into browsable Backup2FS file system with per-file MD5/SHA1/SHA256 CSV logging.

Docker & Container DFIR: Audit container escape risks, scan environment variables for exposed secrets/API keys, extract raw configs and logs, package runtime Overlay2 UpperDir drift layers, and stream remote container evidence via Linux Agent.

Case Management & Verification: Store acquisitions, notes, hashes, reports, and case_manifest.json integrity inventories. Calculate MD5, SHA1, SHA256, and SHA512 hashes, mount supported images read-only, and generate comprehensive forensic reports.