Difference between revisions of "Memory Imaging"

From Forensics Wiki
Jump to: navigation, search
Line 2: Line 2:
  
 
Memory imaging is the process of making a bit-by-bit copy of memory. In principle it is similar to [[Disk Imaging]].
 
Memory imaging is the process of making a bit-by-bit copy of memory. In principle it is similar to [[Disk Imaging]].
 
  
 
For physical memory it is common to have sections that are not accessible, e.g. because of memory-mapped I/O
 
For physical memory it is common to have sections that are not accessible, e.g. because of memory-mapped I/O
 +
 +
The resulting copy is stored in a [[:Category:Forensics_File_Formats|Forensics image format]].
 +
Some of these formats have means to differentiate between an image of memory and e.g. that of a disk.
  
 
== Also see ==
 
== Also see ==

Revision as of 06:14, 27 July 2012

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Memory imaging is the process of making a bit-by-bit copy of memory. In principle it is similar to Disk Imaging.

For physical memory it is common to have sections that are not accessible, e.g. because of memory-mapped I/O

The resulting copy is stored in a Forensics image format. Some of these formats have means to differentiate between an image of memory and e.g. that of a disk.

Also see

Memory Imaging Tools

External Links