1

I've been researching about creating disk images and memory dumps of a system in use for forensic purposes. I've seen that ProcDump can dump a single process' memory, but I was hoping I could find something that allowed dumping the entire memory space.

Any recommendations? It's for academic purposes, so non-paid options are preferred.

2
  • Try hibernation (hiberfil.sys), or VM with the snapshot functionality.
    – ilkhd
    Dec 8, 2015 at 15:10
  • have you tried LiveKD? Dec 30, 2015 at 15:35

1 Answer 1

1

You can use LiveKD from sysinternals to do create a full dump.

Copy LiveKD into the Debugging Tools folder, run it, configure the symbols and in the KD prompt type .dump /f D:\CompleteMemory.dmp to generate a dump.

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .