A Small RAM Dumper

When freezing RAM (the Princeton way) or rapidly powercycling a machine (The Guillotine) you will need a small tool to obtain the memory image, like msramdmp by Robert Wesley McGrew.

msramdmp is a small RAM dumper that can be launched from the SYSLINUX environment.

The dumper will create a copy of the main memory on the first partition that has been marked with type 0x40. Upon completion it will change the partition type to 0x41. The memory image then could be extracted by means of dd or a similar tool.

McGrew provides verbose instructions on how to prepare the media for his msramdmp. There's also a post in his blog that covers the integration into a first responser's USB thumb drive.

Archives

Imprint

This blog is a project of:
Andreas Schuster
Im Äuelchen 45
D-53177 Bonn
impressum@forensikblog.de

Copyright © 2005-2012 by
Andreas Schuster
All rights reserved.
Powered by Movable Type 5.12