Volatility Framework - Revision history

Joachim Metz: /* Windows */

2012-07-31T19:16:15Z

‎Windows

2012-07-31T19:15:39Z

‎Windows

2012-07-28T07:40:38Z

2012-07-28T07:40:09Z

2012-07-27T12:37:17Z

‎Windows

2012-07-27T11:52:44Z

2012-07-27T10:02:03Z

‎Memory acquisition drivers

2012-07-27T09:56:08Z

‎External Links

2012-07-27T09:40:17Z

2012-07-27T09:31:51Z

@@ Line 103: / Line 103: @@
 Note that running dd directly on this device file can crash the machine.
-Use the winpmem tool because it handles protected memory regions.
+Use the winpmem.exe tool instead because it handles protected memory regions.
 To read and acquire the physical memory and write it to image.raw:

@@ Line 101: / Line 101: @@
 \\.\pmem
 </pre>
 To read and acquire the physical memory and write it to image.raw:

@@ Line 75: / Line 75: @@
 === Windows ===
-Since recent versions of Windows require a signed driver, the volatility scudette branch comes with both pre-built (binary) and source versions of the driver. The prebuilt binary is signed.
+Since recent versions of Windows require a signed driver, the volatility scudette branch comes with both pre-built (signed binary) and source versions of the driver.
 Both the i386 and amd64 binary version of the driver can be found on the [http://code.google.com/p/volatility/downloads/list downloads] part of the Volatility code repository as a package named '''winpmem''' or in the scudette branch under:

@@ Line 75: / Line 75: @@
 === Windows ===
-Since recent versions of 64 bit Windows require a signed driver the volatility scudette branch comes with both pre-built (binary) and source versions of the driver. The prebuilt binary is signed.
+Since recent versions of Windows require a signed driver, the volatility scudette branch comes with both pre-built (binary) and source versions of the driver. The prebuilt binary is signed.
 Both the i386 and amd64 binary version of the driver can be found on the [http://code.google.com/p/volatility/downloads/list downloads] part of the Volatility code repository as a package named '''winpmem''' or in the scudette branch under:

@@ Line 77: / Line 77: @@
 Since recent versions of 64 bit Windows require a signed driver the volatility scudette branch comes with both pre-built (binary) and source versions of the driver. The prebuilt binary is signed.
-Both the i386 and amd64 binary version of the driver can be found on the [http://code.google.com/p/volatility/downloads/list downloads] part of the Volatility code repository as winpmem or in the scudette branch under:
+Both the i386 and amd64 binary version of the driver can be found on the [http://code.google.com/p/volatility/downloads/list downloads] part of the Volatility code repository as a package named '''winpmem''' or in the scudette branch under:
 <pre>
 volatility/tools/winpmem/binaries/

@@ Line 3: / Line 3: @@
    maintainer = [[AAron Walters]] |
    os = {{Cross-platform}} |
-   genre = {{Memory analysis}} |
+   genre = {{Memory analysis}}, {{Memory imaging}} |
    license = {{GPL}} |
    website = [https://www.volatilesystems.com/default/volatility https://www.volatilesystems.com/] |

@@ Line 69: / Line 69: @@
 volatility/tools/linux/README
 </pre>
 === Windows ===

@@ Line 118: / Line 118: @@
 == External Links ==
 * [https://www.volatilesystems.com/default/volatility Official web site]
-* [http://code.google.com/p/volatility/ Code repository], Direct link to [http://code.google.com/p/volatility/source/browse/ source]
+* [http://code.google.com/p/volatility/ Code repository], direct link to [http://code.google.com/p/volatility/source/browse/ source]
 * [http://code.google.com/p/volatility/w/list Volatility Documentation]

@@ Line 26: / Line 26: @@
 In the scudette branch the drivers can be found under:
 <pre>
-volatility/tools/linux and volatility/tools/
+volatility/tools/linux
 </pre>