0

I want to analyze the traces of a program in my VM by executing it and then capturing the memory and disk using FTK Imager.

However, it looks like --given the environment I have-- the program only runs for a couple seconds, and --since the target program is done before FTK ends-- the memory snapshot doesn't show the executable at all.

What would you do given this situation?

Improve this question
4
  • FTK Imager only captures non-running disk content, not memory.
    – user10216038
    Sep 24, 2021 at 17:45
  • There is a button to capture memory
    – Néstor Llop
    Sep 24, 2021 at 18:32
  • Funny! I never used FTK Imager for memory capture, didn't even realize the capability was there. So Volatility doesn't show any memory remnants in the dump? Since this is a VM, have you tried simply suspending the VM in lieu of a dump? If this is a Windows system, try using sysinternals to watch the processes.
    – user10216038
    Sep 25, 2021 at 0:25
  • You understood correctly. Volatility doesn't have anything about the program. I'll try what you say, though.
    – Néstor Llop
    Sep 25, 2021 at 6:41

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.