Good point! I'll make a note to test which ones do that. I was fortunate with the last Zues I tested, I found it in the hiberfil.sys. (Win32dd and fdpro images did not complete so I went for the hibernate) Do you know which ones remove themselves? I'd like to test catching them in a memory image, hibernate, and a keyboard generated crash. Is there malware that stops all imaging programs and removes itself for hibernate and crash dump? Does it overwrite itself in memory too? That is an interesting problem! hopefully it is not widespread in the wild. Thanks! Mike Lambert

Thanks AAron, I was able to cause a crash dump via the keyboard and collect a full memory crash dump. The original problem was that I would BSOD a Windows 7 x64 system while trying to get a memory image. That was a big deal because in a response situation, blowing away memory with your efforts (and therefore losing all vaolitle info) was a problem. Thats what I meant about "...BSOD and analysis...". You are correct, I can use a full memory crash dump with Volatility. Vol 2.0 will process it directly; Vol13 requires it to be converted with dmp2bin (no problem) I started with Windows XP and will move on testing. If I run across any problems I'll let you know (as requested). Thanks for the help! Volatility rocks! Mike (info on processing with vol13 and vol20 below in case anyone is interested) C:\Python27\Volatility-1.3_Beta>python volatility ident -f e:\tests\120310_crash _dump\fullmemory.dmp Traceback (most recent call last): File "volatility", line 219, in <module> main() File "volatility", line 212, in main modules[argv[1]].execute(argv[1], argv[2:]) File "C:\Python27\Volatility-1.3_Beta\vmodules.py", line 62, in execute self.cmd_execute(module, args) File "C:\Python27\Volatility-1.3_Beta\vmodules.py", line 84, in get_image_info (addr_space, symtab, types) = load_and_identify_image(op, opts, True) File "C:\Python27\Volatility-1.3_Beta\vutils.py", line 201, in load_and_identi fy_image ImageType = find_csdversion(addr_space, types) File "C:\Python27\Volatility-1.3_Beta\forensics\win32\tasks.py", line 306, in find_csdversion process_address_space = process_addr_space(addr_space, types, task, addr_spa ce.base.fname) AttributeError: WindowsCrashDumpSpace32 instance has no attribute 'fname' C:\Python27\Volatility-1.3_Beta>path PATH=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;c:\python27;c:\tool s;C:\WINDOWS\system32\WindowsPowerShell\v1.0 C:\Python27\Volatility-1.3_Beta>dmp2bin e:\tests\120310_crash_dump\fullmemory.dm p e:\fullmemory.bin dmp2bin - 1.0.20100405 - (Community Edition) Convert Microsoft crash dump files into raw memory dump images. Copyright (C) 2007 - 2010, Matthieu Suiche <http://www.msuiche.net> Copyright (C) 2009 - 2010, MoonSols <http://www.moonsols.com> Initializing memory descriptors... Done. Sorting 4 entries... 0 seconds. Loading file... Done. [0x000000001FE80000 of 0x000000001FE80000] Total time for the conversion: 0 minutes 17 seconds. C:\Python27\Volatility-1.3_Beta>python volatility ident -f e:\tests\120310_crash _dump\fullmemory.bin Image Name: e:\tests\120310_crash_dump\fullmemory.bin Image Type: Service Pack 3 VM Type: nopae DTB: 0x39000 Datetime: Sat Mar 10 16:14:26 2012 C:\Python27\Volatility-1.3_Beta> C:\Python27\volatility-2.0>python vol.py imageinfo -f e:\120310_crash_dump\fullm emory.dmp Volatile Systems Volatility Framework 2.0 ERROR : volatility.plugins.fileparam: The requested file doesn't exist C:\Python27\volatility-2.0>python vol.py imageinfo -f e:\tests\120310_crash_dump \fullmemory.dmp Volatile Systems Volatility Framework 2.0 Determining profile based on KDBG search... Suggested Profile(s) : WinXPSP3x86, WinXPSP2x86 (Instantiated with Win XPSP2x86) AS Layer1 : JKIA32PagedMemory (Kernel AS) AS Layer2 : WindowsCrashDumpSpace32 (E:\tests\120310_crash_ dump\fullmemory.dmp) AS Layer3 : FileAddressSpace (E:\tests\120310_crash_dump\fu llmemory.dmp) PAE type : No PAE DTB : 0x13054000 KDBG : 0x8054ce60L KPCR : 0xffdff000L KUSER_SHARED_DATA : 0xffdf0000L Image date and time : 2012-03-10 22:14:26 Image local date and time : 2012-03-10 22:14:26 Number of Processors : 1 Image Type : Service Pack 3 C:\Python27\volatility-2.0>python vol.py imageinfo -f e:\tests\120310_crash_dump \fullmemory.bin Volatile Systems Volatility Framework 2.0 Determining profile based on KDBG search... Suggested Profile(s) : WinXPSP3x86, WinXPSP2x86 (Instantiated with Win XPSP2x86) AS Layer1 : JKIA32PagedMemory (Kernel AS) AS Layer2 : FileAddressSpace (E:\tests\120310_crash_dump\fu llmemory.bin) PAE type : No PAE DTB : 0x39000 KDBG : 0x8054ce60L KPCR : 0xffdff000L KUSER_SHARED_DATA : 0xffdf0000L Image date and time : 2012-03-10 22:14:26 Image local date and time : 2012-03-10 22:14:26 Number of Processors : 1 Image Type : Service Pack 3 C:\Python27\volatility-2.0>