Re: Acquiring/Capturing Memory

[Louis APONTE <LouisAponte () WEBER EDU>]

Lance
 
I do not have much occasion to capture memory outside of a wayward process misbehaving or failing. The activity monitor 
feature where you can pick the process and then sample a particular PID in memory really works well.  It is limited to 
a few hundred samples with a millisecond between samples for about 3 seconds. I do not think this is what you are 
looking for, but it may help someone else supporting Macs. I think it was available pre Mt. Lion but I won't swear to 
that.
 
 
insert quaint colloquialisms here
 
 

 
 
Louis Aponte

Weber State University

 
> > > On 5/10/2012 at 11:58 AM, in message <96E1873B248FB94186723C4B09BCB97E68FA67 () lapis1604 UTSARR NET>, Lance 
> > > Pritchard <Lance.Pritchard () UTSA EDU> wrote:


Can anyone recommend a utility/tool to acquire memory from Mac OS  for forensic analysis.  Free is preferred, but 
welcome all input.  
 
Thanks
 
Lance
 
lance.pritchard () utsa edu
 
210-458-7218
 
-- 
Lance Pritchard
Office of Information Security (OIS)
The University of Texas at San Antonio