Hello,

 

As part of an assignment for a security and privacy class I am taking I need to determine the ip address of a windowsXP system whose memory dump I have. Actually, it is the zeus.vmem dump from the volatility dump images download page.

 

I have done a lot of searching in google, but haven’t been able to find much about hwo to get this information.

 

I tried the technique outlined at:

http://code.google.com/p/volatility/wiki/CommandReference

 

in the area concerning strings.

When I use the perl script provided the only obvious ip address is 172.16.176.143 which is a private network address. My assignment is to determine the country of origin of the ip address, but so far I see no addresses which are not private addresses.

 

Does anyone have any suggestions on how to proceed with finding the system’s ip address?

 

--
Best Regards, Donald

Oracle
Donald raikes | Accessibility Specialist/ QA Engineer
Phone: +15202717608 | Mobile: +15202717608
Oracle Quality Assurance
| Tucson, Arizona

Green Oracle

Oracle is committed to developing practices and products that help protect the environment