Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows 7 64 bit SP1). I have downloaded a live memory analysis tool named Volatility and tried the first command:

python vol.py pslist -f /path/to/memory.img --profile=Win7SP1x64=

I got an error stating that I don't have image or file for analysis and realised I have no clue how to dump live O/S memory into a file.

I did some Google search for tools e.g encase, helix, MDD, hBGARY but found these tools to be far complex for my current knowledge about this field. Furthermore these tools aren't free.

share|improve this question
@Gilles i did state that fact but somehow the editor named Rory Alsop cropped that text out. Let me say it again its window 7 64 bit sp1. – Saladin Aug 18 '12 at 19:14

3 Answers

up vote 6 down vote accepted

If you google for forensic memory dump tools, one of the first ones to come up is the free Microsoft SysInternals tool, LiveKd. Helix is also free, and has greater functionality. Download the Helix ISO and have a good look at the tools available.

As far as complexity, all these tools provide a wide range of functionality. This shouldn't be confused with being too complex, as you will just use the functions you need. This goes for Volatility as well.

share|improve this answer
Thank you for your post. I will try with Helix ISO and see how well it goes. – Saladin Aug 18 '12 at 19:16
LiveKd rocks. Not sure what I'd do without it. – Polynomial Aug 19 '12 at 20:03
up vote 0 down vote

Try DumpIt. The dumps can be used with volatility.

share|improve this answer
up vote 0 down vote

RamCapture worked for me pretty well - it just needs admin rights.

http://forensic.belkasoft.com/en/ram/download.asp

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.