Username / email:   Password:
or or
Exit Theater Mode

Login or register to enable this feature.

Or, compose an email to send yourself.

Share this video
  • Share via email

View by:

Rob Fuller, aka Mubix, of Room362.com joins us to expand on last week's discussion about the Cold Boot attacks. We cover retrieving memory from live systems, analysis with tools like volatility, and file recovery with foremost. Mubix calls it forensics for the gray hat.

Finding, Imaging, and Playing With Ram

This time we're imaging memory from live systems. Windows boxes specifically. I point out my favorite open source app win32dd, which allows retrieval of physical memory in a couple of methods. Mubix is a fan of ManTech's MDD. Both of these tools are capable of capturing memory on Windows 2003 SP1 (Vista+) and later machines. More tools can be found at the Forensics Wiki.

Tell your friends about this video:

What's in your RAM?

Tuesday, July 14th, 2009

All Segments From This Episode