Re: Dumping RAM contents on Win NT / 2000

From: Dominique Brezinski <dom(at)decru.com>
Date: Tue Nov 12 2002 - 15:25:46 EST

You are right...I was thinking of the work we just did to read raw physical *drives*, which do have a file object mapping. Indeed the physical memory device needs to be memory mapped and is subject to the conditions you mention. My bad.

Dom
----- Original Message -----
From: "George M. Garner Jr." <gmgarner@erols.com> To: <forensics@securityfocus.com>
Sent: Tuesday, November 12, 2002 11:11 AM Subject: RE: Dumping RAM contents on Win NT / 2000

> Dom,
>
> >>You can write a simple C program that opens the file

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Tue Nov 12 16:24:22 2002