June 2006 Archives

As it has been shown in two earlier posts it definitely is possible to reconstruct a program file from a full memory dump. However there's no guarantee the file will run properly. I'm going to explain the reason in this article.

I'm excited to announce that my paper for DFRWS 2006 has been accepted. It is entitled Searching for Processes and Threads in Microsoft Windows Memory Dumps.