Post-Mortem RAM Forensics - CanSecWest
Post-Mortem RAM Forensics - CanSecWest
Post-Mortem RAM Forensics - CanSecWest
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<strong>CanSecWest</strong>2007<br />
33<br />
PoC: Demo<br />
• On a removable hard drive<br />
– raw style captures via helix dd<br />
– Crash style captures via<br />
nonmyfault.exe & crashdump<br />
• Just typical PERL<br />
– Activestate<br />
– Cross platform<br />
• The idea is to replicate as much or<br />
more information that Windows<br />
Task Manager<br />
VIDAS