All Questions
Tagged with digital-forensics memory
14 questions
0
votes
1
answer
273
views
Extract certificate information of a process from memory dump
I have a .dmp file for googleupdate.exe process. I wanted to check in WinDbg this process has a certificate or not in order to detect this process has modified or not because this process has tried ...
1
vote
0
answers
105
views
Can I see Stack and Heap value/addresses from this simple C# program process?
I am studying reading dumped memory image and analyzing it with volatility.
I wrote this c# program and I was hoping to see the analyzed data from Volatiliy
namespace CSharpEx1
{
class Program
...
- 111
3
votes
2
answers
7k
views
Volatility - manually inspect heap of a process
According to the book The Art of Memory Forensics[1], there is a heaps plugin that can extract out information from the heap memory of a process. I'm using latest version of volatility - 2.6 , but the ...
- 31
4
votes
0
answers
170
views
DSi Data Recovery Process?
I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it.
After looking closely at the system, it appears that the memory must be integraded onto ...
- 141
3
votes
2
answers
7k
views
Tools for Windows 10 hiberfil.sys file analysis
As I know Rekall and Volatility don't support Windows 10 hiberfil.sys analysis. Corresponding issue marked with Win 8/Win 10 is still opened.
Is there any tools (free, paid, open source, any) that ...
- 131
1
vote
1
answer
306
views
How would I go about imaging a propriatary flash or eeprom memory chip?
I've been playing around a lot with the xeltek reader, which lets me image various memory chips. Usually, I just use the catalog number used to get the chip's datasheet and search xelteks database for ...
- 51
4
votes
0
answers
208
views
Trying to obtain embedded flash memory on MCP5554 microcontroller
I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go.
...
- 51
7
votes
2
answers
6k
views
How to retrieve assembly from a raw memory dump?
I have a running memory dump saved as a raw binary file. This isn't a standalone executable - it's literally just a snapshot of running memory.
I'm looking for a tool that will help me identify ...
- 181
1
vote
1
answer
1k
views
Can either volatility or GDB dump only the heap memory of a process under Linux?
What I am looking to do is programmatically analyze the contents of each processes heap on a system I control. I've been searching for an easily scriptable way to do this with either gdb, or ...
- 1,258
2
votes
3
answers
4k
views
tools - Free Windows Memory Toolkit for x64
I have seen the Moonsols Memory Toolkit for Windows (Community Edition). It however does not support x64 memory dumping. Only its professional version can do that. Are there any free alternatives out ...
- 203
2
votes
2
answers
480
views
VADs with RWX permission in winlogon.exe process
On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VADs with ...
- 197
7
votes
1
answer
807
views
Modules that exist in a process address space
Using volatility to inspect a services.exe process in a memory dump, I built a list of dll's that are loaded in the process space. (The modules are from the InLoadOrder module list)
This is just an ...
- 197
4
votes
0
answers
330
views
Finding the correlation of imported dll's and executable vad's of a process
The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled.
...
- 197
2
votes
1
answer
733
views
Memory forensics: disabled pagefile but still not everything in memory
I'm doing memory forensics with volatility and pefile on Windows XP SP2 memory dumps.
I run windows in a VirtualBox VM and aquire the dumps with vboxmanage debugvm dumpguestcore --filename dump....
- 197