Harlan, thanks for the link but what I am try to achieve is more like the sop I got from Nate a while ago if you send me your email I will forward it to you also here is mine. Sorry I did not catch that in your last email.
paul.cirillo@inotherapy.com
Cirillop,
The link wasn't intended for you, nor was my previous question intended for you. You'll notice that I started each by referencing "ac_forensics".
Sorry
Sorry I haven't gotten back before now. Yes, Harlan, that is the white paper.
A
Ac_forensics,
Ah, okay. I wouldn't call it "a very thorough white paper on Windows IR", as according to the contents of the white paper, the objective is
The objective of this white paper is to provide initial information on methods, techniques and tools to facilitate acquisition and processing of system and application memory from Windows systems.
There are a great many things about Windows IR that the whitepaper leaves completely unaddressed. However, it is a very good (and still relevant) paper on it's topic…tools to facilitate acquisition and processing of memory from Windows systems.
H