Notifications
Clear all

RAM Analysis

kastajamah
(@kastajamah)
Active Member

Good morning everyone,

Does anyone know of a RAM analysis tool that will work with Windows RAM capture from a 1909 build?

I have tried Volatility 3.0, but to no avail.

Quote
Topic starter Posted : 28/01/2021 4:23 pm
Bunnysniper
(@bunnysniper)
Active Member

Good question. Even Volatility 2 does not have a profile for it.
https://github.com/volatilityfoundation/volatility/wiki/2.6-Win-Profiles

You could try Volexity, the commercial platform at 
https://www.volexity.com/company/contact/request-a-demo/

Andrew Case and his team are very responsive and I bet they are already working on a possibility to analyze 1909 versions. You could also simply ask him on Twitter.

That would be my approach.

 

regards, Robin

 

ReplyQuote
Posted : 31/01/2021 10:42 am
kastajamah
(@kastajamah)
Active Member

@bunnysniper thank you for the suggestions, and I will look into both options.  Have a good day!

ReplyQuote
Topic starter Posted : 03/02/2021 7:14 pm
Share: