Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows 7 64 bit SP1). I have downloaded a live memory analysis tool named Volatility and tried the first command:

python vol.py pslist -f /path/to/memory.img --profile=Win7SP1x64=

I got an error stating that I don't have image or file for analysis and realised I have no clue how to dump live O/S memory into a file.

I did some Google search for tools e.g encase, helix, MDD, hBGARY but found these tools to be far complex for my current knowledge about this field. Furthermore these tools aren't free.

share|improve this question
    
Isn't the memory stored in hiberfil.sys when you hibernate? You could read that file with a Linux live boot. –  Luc Jun 19 '13 at 19:33
add comment

4 Answers

up vote 6 down vote accepted

If you google for forensic memory dump tools, one of the first ones to come up is the free Microsoft SysInternals tool, LiveKd. Helix is also free, and has greater functionality. Download the Helix ISO and have a good look at the tools available.

As far as complexity, all these tools provide a wide range of functionality. This shouldn't be confused with being too complex, as you will just use the functions you need. This goes for Volatility as well.

share|improve this answer
    
Thank you for your post. I will try with Helix ISO and see how well it goes. –  Saladin Aug 18 '12 at 19:16
    
LiveKd rocks. Not sure what I'd do without it. –  Polynomial Aug 19 '12 at 20:03
add comment

I believe that ProcDump also works and is maintained by Microsoft. It allows a dump to occur when certain conditions are met like a high CPU usage.

share|improve this answer
add comment

RamCapture worked for me pretty well - it just needs admin rights.

http://forensic.belkasoft.com/en/ram/download.asp

share|improve this answer
add comment

Try DumpIt. The dumps can be used with volatility.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.