Vista Physical Memory Forensics

Have you tried Mandiant's tool?

I am assuming that you are trying to capture volatile memory. In the past, I have used Mandiant's mdd.exe and now there is newer tool Matthieu Suiche's win32dd.exe which looks pretty good. I haven't used it yet though.

I am assuming that you are trying to capture volatile memory.

Mdd.exe is from ManTech, not Mandiant.

In the past, I have used Mandiant's mdd.exe and now there is newer tool Matthieu Suiche's win32dd.exe which looks pretty good. I haven't used it yet though.

I'm not sure what your response has to do with the original question
"Does anyone know of a tool or script to parse an image of physical memory from a vista PC?"

It would appear that the OP already has the contents of physical memory, and is looking for a means of extracting data from it. I would suggest looking at Memoryze, from Mandiant.

I suppose that the OP is looking for free tools. Both Volatile Systems (https://www.volatilesystems.com/) and GMG Systems, Inc. (http//www.gmgsystemsinc.com/knttools/) offer commercial services and/or tools capable of analyzing Vista memory images. The OP will be more likely to find answers concerning these solutions if he contacts the companies directly using the contact information on their respective web pages.

Harlan
It seems that the tool still doesn't support vista memory image. Any other good tool for vista memory image analysis?

I am assuming that you are trying to capture volatile memory.

I'm not sure what your response has to do with the original question
"Does anyone know of a tool or script to parse an image of physical memory from a vista PC?"

It would appear that the OP already has the contents of physical memory, and is looking for a means of extracting data from it. I would suggest looking at Memoryze, from Mandiant.

I think X-Ways Forensics v15.2 is another very good tool for Vista memory image analysis.

Harlan
It seems that the tool still doesn't support vista memory image. Any other good tool for vista memory image analysis?

I hope to look at HBGary's Responder product again soon…but am I to understand that Memoryze doesn't work with Vista memory dumps?

I think X-Ways Forensics v15.2 is another very good tool for Vista memory image analysis.

v.15.2 is still in beta state..

No Vista support yet for Memoryze.

http//www.mandiant.com/software/mmdld.htm