Re: [Vol-users] 29c3 defeating windows memory forensics
George M. Garner Jr.
29 Dec
2012
29 Dec
'12
6:09 p.m.
On 12/29/2012 5:56 PM, George M. Garner Jr. wrote:
Back about 10 years ago Rob Lee gave a talk at one of
the first SANS
conferences back when he was still auditioning to teach at SANS in which
he described acquiring a hard drive a few bytes at a time from an
infected system to avoid tipping off the "bad guy." Very smart guy that
Rob Lee!
A few bytes at a time over a one month period, I meant to say.