Re: Dumping RAM contents on Win NT / 2000

From: Dominique Brezinski <dom(at)decru.com>
Date: Mon Nov 11 2002 - 16:25:31 EST

You can write a simple C program that opens the file \\.\PhysicalMemory and uses the C runtime read() call to read the contents, or you can download a modified dd that can do it from http://users.erols.com/gmgarner/forensics

Dom
----- Original Message -----
From: "John Smith" <for3nsics@yahoo.com.au> To: <focus-ms@securityfocus.com>
Cc: <forensics@securityfocus.com>
Sent: Sunday, November 10, 2002 2:40 PM
Subject: Dumping RAM contents on Win NT / 2000

> Hi all,
<snip>

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Tue Nov 12 08:55:22 2002