New answers tagged


On a Windows machine, inspecting the memory of the IE process is limited to the owner user, and administrators. If an attacker can inspect the memory of your IE process, then that attacker has taken control of your machine and/or your account, and you are already doomed. If the machine is "shared" then there is no really good solution: if an hostile entity ...


Microsoft has a knowledge base article about this for debugging which will effectively provide the desired result. How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2 Forensics Wiki maintains a great list. Note that some tools only work for x86 so be sure x64 is also supported (i.e. FTK Imager).

Top 50 recent answers are included