Re: Dumping RAM contents on Win NT / 2000

From: Knut Eckstein <knut(at)acm.org>
Date: Mon Nov 11 2002 - 13:40:56 EST

John,

there is an enhanced version of GNU dd for Win* which provides what you need

dd.exe if=\\.\PhysicalMemory of=d:\images\PhysicalMemory.img

Sorry, I don't remember the download location off my head, just google for dd.exe and physical memory...

Best regards,

Knut

John Smith wrote:
> I'm conducting some test forensics work on both

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Nov 11 13:44:28 2002