RE: [Vol-users] BSOD while collecting a memory image

Thanks AAron, I was able to cause a crash dump via the keyboard and collect a full memory crash dump. The original problem was that I would BSOD a Windows 7 x64 system while trying to get a memory image. That was a big deal because in a response situation, blowing away memory with your efforts (and therefore losing all vaolitle info) was a problem. Thats what I meant about "...BSOD and analysis...". You are correct, I can use a full memory crash dump with Volatility. Vol 2.0 will process it directly; Vol13 requires it to be converted with dmp2bin (no problem) I started with Windows XP and will move on testing. If I run across any problems I'll let you know (as requested). Thanks for the help! Volatility rocks! Mike (info on processing with vol13 and vol20 below in case anyone is interested) C:\Python27\Volatility-1.3_Beta>python volatility ident -f e:\tests\120310_crash _dump\fullmemory.dmp Traceback (most recent call last): File "volatility", line 219, in <module> main() File "volatility", line 212, in main modules[argv[1]].execute(argv[1], argv[2:]) File "C:\Python27\Volatility-1.3_Beta\vmodules.py", line 62, in execute self.cmd_execute(module, args) File "C:\Python27\Volatility-1.3_Beta\vmodules.py", line 84, in get_image_info (addr_space, symtab, types) = load_and_identify_image(op, opts, True) File "C:\Python27\Volatility-1.3_Beta\vutils.py", line 201, in load_and_identi fy_image ImageType = find_csdversion(addr_space, types) File "C:\Python27\Volatility-1.3_Beta\forensics\win32\tasks.py", line 306, in find_csdversion process_address_space = process_addr_space(addr_space, types, task, addr_spa ce.base.fname) AttributeError: WindowsCrashDumpSpace32 instance has no attribute 'fname' C:\Python27\Volatility-1.3_Beta>path PATH=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;c:\python27;c:\tool s;C:\WINDOWS\system32\WindowsPowerShell\v1.0 C:\Python27\Volatility-1.3_Beta>dmp2bin e:\tests\120310_crash_dump\fullmemory.dm p e:\fullmemory.bin dmp2bin - 1.0.20100405 - (Community Edition) Convert Microsoft crash dump files into raw memory dump images. Copyright (C) 2007 - 2010, Matthieu Suiche <http://www.msuiche.net> Copyright (C) 2009 - 2010, MoonSols <http://www.moonsols.com> Initializing memory descriptors... Done. Sorting 4 entries... 0 seconds. Loading file... Done. [0x000000001FE80000 of 0x000000001FE80000] Total time for the conversion: 0 minutes 17 seconds. C:\Python27\Volatility-1.3_Beta>python volatility ident -f e:\tests\120310_crash _dump\fullmemory.bin Image Name: e:\tests\120310_crash_dump\fullmemory.bin Image Type: Service Pack 3 VM Type: nopae DTB: 0x39000 Datetime: Sat Mar 10 16:14:26 2012 C:\Python27\Volatility-1.3_Beta> C:\Python27\volatility-2.0>python vol.py imageinfo -f e:\120310_crash_dump\fullm emory.dmp Volatile Systems Volatility Framework 2.0 ERROR : volatility.plugins.fileparam: The requested file doesn't exist C:\Python27\volatility-2.0>python vol.py imageinfo -f e:\tests\120310_crash_dump \fullmemory.dmp Volatile Systems Volatility Framework 2.0 Determining profile based on KDBG search... Suggested Profile(s) : WinXPSP3x86, WinXPSP2x86 (Instantiated with Win XPSP2x86) AS Layer1 : JKIA32PagedMemory (Kernel AS) AS Layer2 : WindowsCrashDumpSpace32 (E:\tests\120310_crash_ dump\fullmemory.dmp) AS Layer3 : FileAddressSpace (E:\tests\120310_crash_dump\fu llmemory.dmp) PAE type : No PAE DTB : 0x13054000 KDBG : 0x8054ce60L KPCR : 0xffdff000L KUSER_SHARED_DATA : 0xffdf0000L Image date and time : 2012-03-10 22:14:26 Image local date and time : 2012-03-10 22:14:26 Number of Processors : 1 Image Type : Service Pack 3 C:\Python27\volatility-2.0>python vol.py imageinfo -f e:\tests\120310_crash_dump \fullmemory.bin Volatile Systems Volatility Framework 2.0 Determining profile based on KDBG search... Suggested Profile(s) : WinXPSP3x86, WinXPSP2x86 (Instantiated with Win XPSP2x86) AS Layer1 : JKIA32PagedMemory (Kernel AS) AS Layer2 : FileAddressSpace (E:\tests\120310_crash_dump\fu llmemory.bin) PAE type : No PAE DTB : 0x39000 KDBG : 0x8054ce60L KPCR : 0xffdff000L KUSER_SHARED_DATA : 0xffdf0000L Image date and time : 2012-03-10 22:14:26 Image local date and time : 2012-03-10 22:14:26 Number of Processors : 1 Image Type : Service Pack 3 C:\Python27\volatility-2.0>