I acquired a memory image using Magnet Forensics RAM capture tool and selected the option to break the image into segments.Â
I would like to import the image into other tools to analyze, however they accept only one file rather than the collection of segmented files.
Is there a way to join the segments into a single memory image file?
This was the solution to my issue to join the files together using the type command and appending the memory segments in order. The first > creates a new file but the others >> append the newly created file.
D:\Images>type image.001 > image_all.img
D:\Images>type image.002 >> image_all.img
D:\Images>type image.002 >> image_all.img
If I remember correctly I think I have done this with regular segmented DD's and E01's - opened them with FTK imager and reacquired the images in a single file. Maybe FTK imager can help you out here.Â
@tic-tac Thank you for your reply. Perhaps I am approaching this incorrectly but I'm not seeing a way to merge the segmented images with FTK Imager.
I see how I could add the separate evidence items and then add the unallocated space as a custom content image. Then I could create a single custom content image however that still leaves me with segmented files in a proprietary format
