Posts Tagged ‘Magnet RAM Capturer’

AXIOM is our one of the best tools. A few days ago Magnet Forensics has released AXIOM V2. Now AXIOM contains many features. We were especially delighted that the functional Volatility appeared in a new version of AXIOM. Volatility is the best tool for memory forensics. The combination of AXIOM and Volatility is clearly an excellent idea. And of course we immediately started testing this functionality.

Jason Hale talks about Memory Acquisition and Virtual Secure Fashion. «Physical memory is commonly acquired using a software-based memory acquisition tool such as winpmem, DumpIt, Magnet RAM Capturer, FTK Imager, or one of the several other options available. These tools typically load a device driver into the kernel and subsequently read memory through mapping the \\Device\PhysicalMemory object, using a function such as MmMapIoSpace, or directly manipulating the page tables. Many of these tools also share a similar trait: their use on a system with virtual secure mode enabled results in a system crash.».