Virtual Machine Memory Acquisition, or where to get which VM memory image.
Slides: http://www.deer-run.com/~hal/Detect_Malware_w_Memory_Forensics.pdf …
#DFIRpic.twitter.com/NjoJiXO8DD
-
the chart is technically wrong, the .bin file of hyper-v systems is not a raw dump file
@hal_pomeranz
-
-
https://www.wyattroersma.com/?p=87 is covering some 2012 + 2012 R2 stuff. It also mentions the previous blog on 2k8
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.