Forencis Software

http//www.forensicfocus.com/digital-forensics-of-physical-memory

http//www.forensicfocus.com/importance-of-memory-search-and-analysis

thanx douglasbrush.I will read it and get back to you

Can you tell how to us dd.exe to take a memory dump of my windows memory.I dont understand what dd command to used for taking the dump.I already have dd.exe.

Thanks in Advance

You do not say what version of Windows so your results may vary or fail completely. That said, the command for dd is at the bottom of the page in the first link Douglas posted. #/mnt/cdrom/dd if=/dev/mem | /mnt/cdrom/nc

You do not say what version of Windows so your results may vary or fail completely. That said, the command for dd is at the bottom of the page in the first link Douglas posted. #/mnt/cdrom/dd if=/dev/mem | /mnt/cdrom/nc

I am using windows 7 ultimate.I want to take windows memory dump and store in my harddrive itself.I am very unfamiliar with dd.exe.Can you now please tell me what command should i run in dd?
Thanks

If you are aiming to dump the whole memory, use mdd.exe at http//sourceforge.net/projects/mdd/files/

It makes imaging memory a breeze.

After that, you can use foremost (or any other tool) to carve out files.

Thanks twjolson,
From what I searched I found that foremost recovers deleted files.But how can I recover files from the dump.Can I use foremost for that?
I want a software that can recover images or files from memory dump.

Can someone tell me about the software which can recover the contents as it was in original format before taking a memory dump using softwares like dd.exe.I know that it can be viewed in hex editor,but suppose that you have a dump of word document,I want it to appear as a whole document which will be very easy to understand instead of viewing from hex editor.

A couple of things…

First, to get the memory dump, you might consider windd.exe over mdd.exe. Mdd.exe is no longer supported.
http//moonsols.com/blog/2-blog/9-moonsols-windows-memory-toolkit

Now, to recover files, you need to know something about the format of files, and the format of memory. I don't know that there are any tools available that work with Windows 7 as of yet, in that regard.