Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Practical Memory Forensics

You're reading from   Practical Memory Forensics Jumpstart effective forensic analysis of volatile memory

Arrow left icon
Product type Paperback
Published in Mar 2022
Publisher Packt
ISBN-13 9781801070331
Length 304 pages
Edition 1st Edition
Tools
Concepts
Arrow right icon
Authors (2):
Arrow left icon
Oleg Skulkin Oleg Skulkin
Author Profile Icon Oleg Skulkin
Oleg Skulkin
Svetlana Ostrovskaya Svetlana Ostrovskaya
Author Profile Icon Svetlana Ostrovskaya
Svetlana Ostrovskaya
Arrow right icon
View More author details
Toc

Table of Contents (17) Chapters Close

Preface 1. Section 1: Basics of Memory Forensics
2. Chapter 1: Why Memory Forensics? FREE CHAPTER 3. Chapter 2: Acquisition Process 4. Section 2: Windows Forensic Analysis
5. Chapter 3: Windows Memory Acquisition 6. Chapter 4: Reconstructing User Activity with Windows Memory Forensics 7. Chapter 5: Malware Detection and Analysis with Windows Memory Forensics 8. Chapter 6: Alternative Sources of Volatile Memory 9. Section 3: Linux Forensic Analysis
10. Chapter 7: Linux Memory Acquisition 11. Chapter 8: User Activity Reconstruction 12. Chapter 9: Malicious Activity Detection 13. Section 4: macOS Forensic Analysis
14. Chapter 10: MacOS Memory Acquisition 15. Chapter 11: Malware Detection and Analysis with macOS Memory Forensics 16. Other Books You May Enjoy

Acquiring memory with Belkasoft RAM Capturer

Belkasoft RAM Capturer is another free tool for memory acquisition. As with the previous tools outlined, it uses kernel drivers to extract the physical memory and create dumps. This tool is compatible with all 32- and 64-bit versions of Windows, including Windows XP, Windows Vista, Windows 7 and 8, Server 2003 and 2008, and Windows 10.

You will need to take the following steps:

  1. To get this tool, go to the Download tab on the official Belkasoft web page at https://belkasoft.com/.
  2. Choose Belkasoft Live RAM Capturer and leave your email in the specified field. After confirmation, you will receive a download link. From this link, you will get an archive with two x64 and x86 folders, which should be extracted to a flash drive.
  3. This time, you need to find out if you're dealing with an x64 or an x86 system. To do so, use the Search box on the taskbar. Type system and run the System Information application, as shown in...
lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime