Post-Mortem RAM Forensics - CanSecWest
Post-Mortem RAM Forensics - CanSecWest
Post-Mortem RAM Forensics - CanSecWest
SHOW LESS
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>CanSecWest</strong>2007<br />
15<br />
The caveat<br />
• Minimal impact is appealing, but the<br />
information is a requirement<br />
• In order to be acceptable, at least the<br />
same amount of information that is<br />
attainable via interaction, must be<br />
attainable via analysis of the copy of<br />
the volatile–<br />
Information gained:<br />
store FromImageFile >= Interactive Response<br />
– Impact to system:<br />
FromImageCreation
Change language