RE: [Vol-users] Windows Server 2008
2 Jul
2012
2 Jul
'12
5:56 p.m.
Troy,
Would you care to share what type of analysis you are performing with
windbg? How frequently are you doing this type of analysis? I'm sure
people would be interested in the types of things you look for and the
steps you typically take to find them. While I use windbg for a number of
things, I don't typically use it during investigations.
As for acquisition, have you ever measured the impact of using livekd as
your acquisition mechanism? Have you found any limitations associated with
this approach? Have you ever run into instances where it conflicted with
installed security software? Do you install livekd as a part of your IR
process?
Thanks,
AW
On Mon, 2 Jul 2012, Troy Larson (NETSEC) wrote:
George,
I will often use livekd -o for generating memory dumps. If I want to get a clean kernel
dump, then I use livekd -m -o.
Troy
-----Original Message-----
From: vol-users-bounces(a)volatilityfoundation.org
[mailto:vol-users-bounces@volatilityfoundation.org] On Behalf Of George M. Garner Jr.
Sent: Monday, July 02, 2012 10:45 AM
To: vol-users(a)volatilityfoundation.org
Subject: Re: [Vol-users] Windows Server 2008
On 7/2/2012 10:59 AM, Troy Larson (NETSEC) wrote:
Windbg.
Troy
One of my favorite tools, aside from KnTList. To my mind it is an
essential tool if you want to get serious about memory analysis. But
then you need to be able to convert your memory dumps to MS crashdump
format.
While I am on the subject, the version of Windbg that ships with w8 RC
WDK includes a .segmentation command which is useful when using Windbg
to analyze 64-bit memory images. Basically, you enter the following two
commands after opening a 64-bit crashdump and all will be joy (with
Windbg):
.segmentation /V /X /a
.effmach . (note literal dot).
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users