Re: [Vol-users] Memory Collection on Windows NT
22 Feb
2013
22 Feb
'13
7:40 p.m.
Terrie,
On windows NT you should be able to dd if=\\.\PhysicalMemory
device directly off without needing a driver. I am not sure if the
exported device masks off DMA regions though so check first.
Michael.
On 22 February 2013 21:08, Myerchin, Terrie A <TAMyerchin(a)directv.com> wrote:
Hi there
We are looking to collect memory on an old Windows NT box. Of course, the
tools we utilize are too recent to be compatible with Windows NT. Does
anyone have any workaround suggestions or tools that may assist with this
memory collection?
Regards,
Terrie
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users