Bugtraq mailing list archives
Forensic memory dumping intricacies - PhysicalMemory, DD, and caching issues
From: Arne Vidstrom <arne.vidstrom () ntsecurity nu>
Date: Thu, 01 Jun 2006 19:22:03 +0200
Summary:Memory dumping tools that use the PhysicalMemory device in Windows XP can be blocked by allocating memory buffers with special memory types. In older versions of Windows the tools instead could possibly cause cache incoherence with some processor types, or other adverse side effects. The problem can also occur on a system that has not been manipulated at all by any attacker. One *example* of an affected tool is DD from the Forensic Acquisition Utilities.
Full text: http://ntsecurity.nu/onmymind/2006/2006-06-01.html Regards /Arne Vidstrom http://ntsecurity.nu http://vidstrom.net
Current thread:
- Forensic memory dumping intricacies - PhysicalMemory, DD, and caching issues Arne Vidstrom (Jun 01)