Are HBGary FastDump Pro dumps compatible with WinDbg?

Question

I have read that HBGary's FastDump Pro (FDPro) can capture kernel dumps and include the page file contents.

Although I'm not sure if the tool is still available commercially (it's not listed on the countertack.com webpage), I'd like to know whether the file format created by FastDump Pro is compatible with WinDbg or if I need other tools to analyze it (HBGary/Countertack tools).

If they are compatible, I see some benefit in having the page file contents included in the dump, since that would e.g. give the possibility of debugging a .NET application from a kernel dump, which is usually not possible since parts of the of the virtual memory have been paged out.

Answer 1

From http://cfile10.uf.tistory.com/attach/1237FF424DB038D6045F5D:

FDPro is capable of exporting in two formats. The first format is industry standard DD RAW format with a ".bin" extension. This process is just a literal zero-to-max_mem_size dump of the physical memory. The second format that is available is known as HPAK. HPAK is an HBGary proprietary format which is capable of several key features, namely the ability to store and archive the RAM and Pagefile in a single archive. HPAK format also supports compression using the gzip format. This is useful during instances where space on the collecting device/system is limited.

So any tool capable of handling raw physical memory dumps should be able to handle FDPro's .bin files.

As for the .hpak files, from https://books.google.com/books?id=5hvSrBGVfIgC:

only HBGary's Responder product can be used to analyze an .hpak format memory dump