Re: FW: [Vol-users] Memory Imaging Using Firewire

If this is a managed system, then if you have a software deployment tool like SMS, Tivoli, or Unicenter can you just send down a job that runs something like Mantech's new MDD.exe tool and write the RAM dump out to a \\servername\sharename\filename? Otherwise, if you have admin access to the machine, can you psexec the MDD.exe tool on the machine and write the RAM dump out to a \\servername\sharename share (mdd -o \\servername\sharename\filename.dd)? Doing either of the above would definitely alter the target machine more than the Firewire method, but might be good enough depending on your situation. -----Original Message----- From: vol-users-bounces(a)volatilityfoundation.org [mailto:vol-users-bounces@volatilityfoundation.org] On Behalf Of AAron Walters Sent: Tuesday, July 08, 2008 4:29 PM To: Jim Gordon Cc: vol-users(a)volatilityfoundation.org Subject: Re: [Vol-users] Memory Imaging Using Firewire evb, There a number of potential techniques that are being used to deal with locked machines. Though I must give my usual caveats that I would make sure you know what you are doing and actually have experience with the acquisition method before trying it as part of a real investigation. Some of the techniques are hardware dependent, have the potential to BSOD the machine, or are potentially destructive, so you may only get one attempt. In some instances, it may be useful to get outside help. As Jim and Jamie mentioned, performing acquisition via firewire is a potential option. Details about this technique can be found on the follow site: http://storm.net.nz/projects/16. They even mention using a CardBus firwire card. Others have successfully used techniques similar to those presented in the Cold Boot paper (http://citp.princeton.edu/memory/) or similarly, msramdmp: (http://mcgrewsecurity.com/projects/msramdmp/) Depending on how the laptop is configured, the hibernation file is another alternative. There are also other hardware solutions but they are very expensive. Regards, AW On Tue, 8 Jul 2008, Jim Gordon wrote: _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users