I want to analyze the traces of a program in my VM by executing it and then capturing the memory and disk using FTK Imager.

However, it looks like --given the environment I have-- the program only runs for a couple seconds, and --since the target program is done before FTK ends-- the memory snapshot doesn't show the executable at all.

What would you do given this situation?

  • FTK Imager only captures non-running disk content, not memory. Sep 24, 2021 at 17:45
  • There is a button to capture memory Sep 24, 2021 at 18:32
  • Funny! I never used FTK Imager for memory capture, didn't even realize the capability was there. So Volatility doesn't show any memory remnants in the dump? Since this is a VM, have you tried simply suspending the VM in lieu of a dump? If this is a Windows system, try using sysinternals to watch the processes. Sep 25, 2021 at 0:25
  • You understood correctly. Volatility doesn't have anything about the program. I'll try what you say, though. Sep 25, 2021 at 6:41


You must log in to answer this question.

Browse other questions tagged .