On Dec 4, 2012 8:02 PM, <vol-users-request@volatilityfoundation.org> wrote:

Send Vol-users mailing list submissions to
        vol-users@volatilityfoundation.org

To subscribe or unsubscribe via the World Wide Web, visit
        http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
or, via email, send a message with subject or body 'help' to
        vol-users-request@volatilityfoundation.org

You can reach the person managing the list at
        vol-users-owner@volatilityfoundation.org

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Vol-users digest..."


Today's Topics:

   1. FTK Imager as RAM dumping tool? (David Kovar)


----------------------------------------------------------------------

Message: 1
Date: Tue, 4 Dec 2012 16:53:00 -0600
From: David Kovar <dkovar@gmail.com>
Subject: [Vol-users] FTK Imager as RAM dumping tool?
To: "vol-users@volatilesystems.com" <vol-users@volatilityfoundation.org>
Message-ID: <0186FBD7-BB31-4380-9B4D-4F0342BE19B1@gmail.com>
Content-Type: text/plain; charset=us-ascii

Good afternoon,

I was just looking at a memory dump that, when compressed, went from 4GB to about 20MB. Something is odd here, I say. Most of the file is nulls.

The dump was collected with FTK Imager. Does anyone have any opinions on its reliability as a memory acquisition tool?

Thanks.

-David



------------------------------

_______________________________________________
Vol-users mailing list
Vol-users@volatilesystems.com
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users


End of Vol-users Digest, Vol 54, Issue 1
****************************************