Comments on Computer Forensics, Malware Analysis & Digital Investigations: Extract MFT records from Memory dump

Mark, Can you contact me directly? Lance(at)fore...

2010-06-30T15:18:27.433-07:00

Mark,

Can you contact me directly? Lance(at)forensickb.com

Lance

Hello, I know I am a little late to the game on t...

2010-06-30T11:40:04.973-07:00

Hello,

I know I am a little late to the game on this, but I just ran this enpack against three memory dumps, one dd file and two vmware vmem files. The enpack output in the console was "A total of 0 search hits were processed, but only 0 valid MFT records were parsed". That is odd, but I used volatility to pull out other file information. Any thoughts or suggestions?

Thanks.

Well, you can still use the version that is floati...

2007-11-14T23:12:00.000-08:00

Well, you can still use the version that is floating around out there on the Internet. The problem is it does not work for Windows 2003 (>=sp1) or Vista because the \\.\PhysicalMemory pipe is not accessible like it was in the past.

I would recommend KnTTools by George Garner at http://www.gmgsystemsinc.com/knttools/. They are not free, but its one of the only viable solutions at this point.

What do you recommend to capture memory? The vener...

2007-11-14T18:12:00.000-08:00

What do you recommend to capture memory? The venerable modified DD is not available for free anymore :(

Paul Bobby