the chart is technically wrong, the .bin file of hyper-v systems is not a raw dump file @hal_pomeranz
Virtual Machine Memory Acquisition, or where to get which VM memory image.
Slides: http://www.deer-run.com/~hal/Detect_Malware_w_Memory_Forensics.pdf …
#DFIRpic.twitter.com/NjoJiXO8DD
-
-
-
Agh. That slide deck is years old. I've learned better since then. Thanks for pointing this out.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.