ForensicsWiki will continue to operate as it has before and will not be shutting down. There may be some minor outages as we transition the site to new hardware, but we will try to minimize this as much as possible. Thank you for your continued support of ForensicsWiki.

Difference between pages "Data Recovery Stories" and "Memory Imaging"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (New page: Amazing stories of data recovery. * [http://blocksandfiles.com/article/5056 May 6, 2008 - Kroll recovers over 90% of the data from a 400MB hard drive that was on Shuttle Columbia when it ...)
 
(Also see)
 
Line 1: Line 1:
Amazing stories of data recovery.
+
{{expand}}
  
* [http://blocksandfiles.com/article/5056 May 6, 2008 - Kroll recovers over 90% of the data from a 400MB hard drive that was on Shuttle Columbia when it burned up on reentry into Earth's atmosphere.]
+
Memory imaging is the process of making a bit-by-bit copy of memory. In principle it is similar to [[Disk Imaging]].
<img src='http://blocksandfiles.com/contentimages/small/shuttle-breakup1.jpg'>
+
 
 +
For physical memory it is common to have sections that are not accessible, e.g. because of memory-mapped I/O
 +
 
 +
The resulting copy is stored in a [[:Category:Forensics_File_Formats|Forensics image format]].
 +
Some of these formats have means to differentiate between an image of memory and e.g. that of a disk.
 +
 
 +
== Methods ==
 +
 
 +
=== Reading from the Physical Memory Object ===
 +
In [[Windows]] the Physical Memory Object, \\Device\PhysicalMemory, can be used the access physical memory. Since Windows 2003 SP1 user-mode access to this device-object is no longer permitted [http://technet.microsoft.com/en-en/library/cc787565(v=ws.10).aspx]. A kernel-mode process is still allowed to read from this device-object.
 +
 
 +
=== MmMapIoSpace ===
 +
 
 +
The MmMapIoSpace function (or routine) is kernel-mode function to map a physical address range to non-paged system space [http://msdn.microsoft.com/en-us/library/windows/hardware/ff554618(v=vs.85).aspx].
 +
 
 +
== Also see ==
 +
* [[Memory analysis]]
 +
* [[:Tools:Memory_Imaging|Memory Imaging Tools]]
 +
 
 +
== External Links ==
 +
* [http://en.wikipedia.org/wiki/Memory-mapped_I/O Wikipedia article on Memory-mapped I/O]
 +
* [http://www.dfrws.org/2013/proceedings/DFRWS2013-13.pdf Anti-forensic resilient memory acquisition], by [[Johannes Stuettgen]] and [[Michael Cohen]], DFRWS 2013
 +
* [http://takahiroharuyama.github.io/blog/2014/01/07/64bit-big-size-ram-acquisition-problem/ 64bit Big Sized RAM Image Acquisition Problem], by [[Takahiro haruyama]], January 7, 2014
 +
* [http://brimorlabs.blogspot.com/2014/01/all-memory-dumping-tools-are-not-same.html All memory dumping tools are not the same], by [[Brian Moran]], January 14, 2014
 +
 
 +
[[Category:Memory Analysis]]

Revision as of 20:19, 14 January 2014

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Memory imaging is the process of making a bit-by-bit copy of memory. In principle it is similar to Disk Imaging.

For physical memory it is common to have sections that are not accessible, e.g. because of memory-mapped I/O

The resulting copy is stored in a Forensics image format. Some of these formats have means to differentiate between an image of memory and e.g. that of a disk.

Methods

Reading from the Physical Memory Object

In Windows the Physical Memory Object, \\Device\PhysicalMemory, can be used the access physical memory. Since Windows 2003 SP1 user-mode access to this device-object is no longer permitted [1]. A kernel-mode process is still allowed to read from this device-object.

MmMapIoSpace

The MmMapIoSpace function (or routine) is kernel-mode function to map a physical address range to non-paged system space [2].

Also see

External Links