As we have already learned: we can copy all of physical memory from our computer using win32dd. This was part of your homework.
There are several practice images available online of different types of Windows OSes.
The image information for your lab is here:
[xp-laptop.tgz | xp-laptop.md5]
Some other things:
Volatility [direct download]
SID [direct download]
System call table [direct download | supporting library]
Windows messages [direct download]
The supporting library goes in the ``forensics/win32/'' folder under Volatility
All other plugins go in the ``memory_plugins/'' folder under Volatility
Finding Initial Access
1 month ago
No comments:
Post a Comment