Dumping RAM contents on Win NT / 2000

From: John Smith (for3nsicsat_private)
Date: Sun Nov 10 2002 - 14:40:08 PST

  • Next message: M. Zeeshan Mustafa: "Re: 2 data recovery questions" 

    Hi all,

I'm conducting some test forensics work on both
Windows NT and 2000 and found myself wanting to "dump"
the contents of memory for volatile data investiation.
Unfortunately I can not find any relevant information
on tools/howto's on this subject, accept setting a
Registry key which requires and initial reboot to take
affect. (which will be useless because after the
reboot the volatile data would be lost). And yes, the
fact that the Reg Key wasn't set is an obvious one as
well :)

Any ideas on how this could be achieved WITHOUT
setting the particular Registry setting.

Thanks in advance.


http://careers.yahoo.com.au - Yahoo! Careers
- 1,000's of jobs waiting online for you!

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

    This archive was generated by hypermail 2b30 : Mon Nov 11 2002 - 10:28:18 PST