Belkasoft RAM Capturer is a free tool any digital forensic examiner should have in their kit. It's tiny, easy to use, and has the ability to acquire memory from Windows systems, including Windows 10, even if they are protected by an active anti-debugging or anti-dumping system.
Windows memory acquisition with Belkasoft RAM Capturer
by Scar de Courcier, Oleg Skulkin
Windows Forensics Cookbook
- Preface
- Digital Forensics and Evidence Acquisition
- Windows Memory Acquisition and Analysis
- Windows Drive Acquisition
- Windows File System Analysis
- Windows Shadow Copies Analysis
- Windows Registry Analysis
- Main Windows Operating System Artifacts
- Introduction
- Recycle Bin content analysis with EnCase Forensic
- Recycle bin content analysis with Rifiuti2
- Recycle bin content analysis with Magnet AXIOM
- Event log analysis with FullEventLogView
- Event log analysis with Magnet AXIOM
- Event log recovery with EVTXtract
- LNK file analysis with EnCase forensic
- LNK file analysis with LECmd
- LNK file analysis with Link Parser
- Prefetch file analysis with Magnet AXIOM
- Prefetch file parsing with PECmd
- Prefetch file recovery with Windows Prefetch Carver
- Web Browser Forensics
- Email and Instant Messaging Forensics
- Windows 10 Forensics
- Data Visualization
- Troubleshooting in Windows Forensic Analysis
Windows memory acquisition with Belkasoft RAM Capturer
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.