[Vol-users] Re: Vol-users Digest, Vol 54, Issue 1

Send Vol-users mailing list submissions to vol-users(a)volatilityfoundation.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.volatilityfoundation.org/mailman/listinfo/vol-users or, via email, send a message with subject or body 'help' to vol-users-request(a)volatilityfoundation.org You can reach the person managing the list at vol-users-owner(a)volatilityfoundation.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Vol-users digest..." Today's Topics: 1. FTK Imager as RAM dumping tool? (David Kovar) ---------------------------------------------------------------------- Message: 1 Date: Tue, 4 Dec 2012 16:53:00 -0600 From: David Kovar <dkovar(a)gmail.com> Subject: [Vol-users] FTK Imager as RAM dumping tool? To: "vol-users(a)volatilityfoundation.org" <vol-users(a)volatilityfoundation.org> Message-ID: <0186FBD7-BB31-4380-9B4D-4F0342BE19B1(a)gmail.com> Content-Type: text/plain; charset=us-ascii Good afternoon, I was just looking at a memory dump that, when compressed, went from 4GB to about 20MB. Something is odd here, I say. Most of the file is nulls. The dump was collected with FTK Imager. Does anyone have any opinions on its reliability as a memory acquisition tool? Thanks. -David ------------------------------ _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users End of Vol-users Digest, Vol 54, Issue 1 ****************************************