Notifications
Clear all

Memory Acquisitions

11 Posts
6 Users
0 Reactions
954 Views
keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
 

now to get to my point i used dd- to acquire image of the ram, – i used the GetData Mount Image Pro v3.2.6.522 to mount but no success it did present me with errors, it says drive needed to formated; what is the best way of view live ram acquisition.

Acquiring memory with dd doesn't give you a disk image…Mount Image Pro won't mount it because it's not a disk image. When you acquire a memory dump, you're not acquiring a disk image with a file system, MBR, partition table, etc. Memory doesn't follow the same format as a file system.


   
ReplyQuote
Page 2 / 2
Share: