How to read virtual memory

NameSniper · Aug 23, 2011

Hi,

Can anyone please let me know how the one may read files from virtual memory(pagefile.sys)? Is there a software to read all files from this file in human readable form?

Jmtyra · Aug 24, 2011

Hi NameSniper,

Interesting question, don't think I've considered that before. Did a quick search online, and found a forum post that might get you started:

Memoryze can make use of the paging file(s) if you run it on a live system.

Jesse's "Using Every Part of the Buffalo in Windows Memory Analysis" paper is a great place to start as well.

Memoryze: http://www.mandiant.com/software/memoryze.htm
Audit Viewer: http://blog.mandiant.com/archives/50
Jesse's paper: http://jessekornblum.com/research/papers/buffalo.pdf

NameSniper · Aug 29, 2011

Jmtyra said:
Hi NameSniper,

Interesting question, don't think I've considered that before. Did a quick search online, and found a forum post that might get you started:

Nice find, thanks.

The only issue is that the pdf file seem to have been deleted.

Jmtyra · Aug 29, 2011

NameSniper said:
Nice find, thanks.

The only issue is that the pdf file seem to have been deleted.

No prob! Hmmm...that sucks.

Hope the other links prove useful.

How to read virtual memory

NameSniper

Registered

Jmtyra

Member

NameSniper

Registered

Jmtyra

Member

Similar threads