ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "Memory Imaging"

From ForensicsWiki
Jump to: navigation, search
Line 2: Line 2:
  
 
Memory imaging is the process of making a bit-by-bit copy of memory. In principle it is similar to [[Disk Imaging]].
 
Memory imaging is the process of making a bit-by-bit copy of memory. In principle it is similar to [[Disk Imaging]].
 
  
 
For physical memory it is common to have sections that are not accessible, e.g. because of memory-mapped I/O
 
For physical memory it is common to have sections that are not accessible, e.g. because of memory-mapped I/O
 +
 +
The resulting copy is stored in a [[:Category:Forensics_File_Formats|Forensics image format]].
 +
Some of these formats have means to differentiate between an image of memory and e.g. that of a disk.
  
 
== Also see ==
 
== Also see ==

Revision as of 11:14, 27 July 2012

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Memory imaging is the process of making a bit-by-bit copy of memory. In principle it is similar to Disk Imaging.

For physical memory it is common to have sections that are not accessible, e.g. because of memory-mapped I/O

The resulting copy is stored in a Forensics image format. Some of these formats have means to differentiate between an image of memory and e.g. that of a disk.

Also see

Memory Imaging Tools

External Links