Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
3
Posts
3
Users
0
Reactions
617
Views
Topic starter
18/12/2008 3:23 am
Hello,
I have been using winen to image memory on my pc. I was wondering if there are any programs which can retrieve thread, processes and object headers in a clearer format? Maybe not retrieve data from memory itself but from the encase image.
Thanks.8)
18/12/2008 3:53 am
Check out Volatility Framework.
18/12/2008 6:49 am
To my knowledge, Volatility doesn't support EnCase image file formats, only raw ones. If you've used WinEn to capture memory, you'll need to run it through FTK Imager and convert it to a raw style image and then you can use some of the open-source tools out there to analyze memory.