[Vol-users] 29c3 defeating windows memory forensics

George M. Garner Jr. ggarner_online at gmgsystemsinc.com
Wed Jan 9 14:04:41 CST 2013

> Unfortunately, that's not the case:(
> The reason is that the checksum is calculated on the buffer *after* it
> has been written to the file (basically the next call after
> ZwWriteFile).
> When Dementia is used, checksum of the dump created by win32dd equals
> to the one printed out in the console.

Zut alors!  This does point out the value of tool testing and not simply 
relying upon manufacturer's representations of what their tools do. 
Dimentia has already served a very useful purpose for the forensic 
community.  Keep up the good work!

More information about the Vol-users mailing list