Join Segmented Memo...
 
Notifications
Clear all

Join Segmented Memory Images

4 Posts
2 Users
0 Reactions
674 Views
(@blindude24)
Posts: 4
Active Member
Topic starter
 

I acquired a memory image using Magnet Forensics RAM capture tool and selected the option to break the image into segments. 

I would like to import the image into other tools to analyze, however they accept only one file rather than the collection of segmented files.

Is there a way to join the segments into a single memory image file?

 
Posted : 14/12/2023 10:11 pm
(@blindude24)
Posts: 4
Active Member
Topic starter
 

This was the solution to my issue to join the files together using the type command and appending the memory segments in order. The first > creates a new file but the others >> append the newly created file.

D:\Images>type image.001 >  image_all.img
D:\Images>type image.002 >> image_all.img
D:\Images>type image.002 >> image_all.img
 
Posted : 15/12/2023 4:21 pm
Tic-Tac
(@tic-tac)
Posts: 26
Eminent Member
 

If I remember correctly I think I have done this with regular segmented DD's and E01's - opened them with FTK imager and reacquired the images in a single file. Maybe FTK imager can help you out here. 

 
Posted : 15/12/2023 5:15 pm
(@blindude24)
Posts: 4
Active Member
Topic starter
 

@tic-tac Thank you for your reply. Perhaps I am approaching this incorrectly but I'm not seeing a way to merge the segmented images with FTK Imager.

I see how I could add the separate evidence items and then add the unallocated space as a custom content image. Then I could create a single custom content image however that still leaves me with segmented files in a proprietary format

 
Posted : 21/12/2023 4:42 pm
Share: