Re: [Vol-users] 29c3 defeating windows memory forensics
George M. Garner Jr.
9 Jan
2013
9 Jan
'13
3:04 p.m.
Unfortunately, that's not the case:(
The reason is that the checksum is calculated on the buffer *after* it
has been written to the file (basically the next call after
ZwWriteFile).
When Dementia is used, checksum of the dump created by win32dd equals
to the one printed out in the console.
Zut alors! This does point out the value of tool testing and not simply
relying upon manufacturer's representations of what their tools do.
Dimentia has already served a very useful purpose for the forensic
community. Keep up the good work!