mailing list archives
Re: Imaging memory on Win7 64bit
From: Josh Little <josh () zombietango com>
Date: Tue, 21 Sep 2010 20:46:03 -0400
-----BEGIN PGP SIGNED MESSAGE-----
On 9/21/2010 4:57 PM, Dave Hull wrote:
Actually, Volatility has had support for Vista memory dumps for a
while now. I'm checking into support for 64-bit images.
I believe @gleeda on Twitter may know the answer.
The 64-bit image (Win7) I tried it against came out with an unknown
image type error. So either it doesn't support it or I'm holding it
wrong :) In brighter news, Mandiant released a new version of Memoryze
today that supports Win 7 in both 32- and 64-bit mode. So I'm back in
business with MoonSols_WinDD (thanks again Carlos) and Memoryze.
PS - Just saw your response Dave about Vista/Win7 support from
Volatility. Thanks for checking on that.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----
Pauldotcom mailing list
Pauldotcom () mail pauldotcom com
Main Web Site: http://pauldotcom.com
Re: Imaging memory on Win7 64bit Matt Nelson (Sep 18)