VolExp

VolExp Volatility Explorer Questo programma permette all'utente di accedere a un Memory Dump. Può anche funzionare come plugin per il Volatility Framework https://github.com/volatilityfoundation/volatility. Questo programma funziona in modo simile a Process Explorer/Hacker, ma in più permette...

VolExp - Volatility Explorer

This program allows the user to access a Memory Dump. It can also function as a plugin to the Volatility Framework https://github.com/volatilityfoundation/volatility. This program functions similarly to Process Explorer/Hacker, but additionally it allows the user access to a Memory Dump or access...

Query Windows Machine for RAM Artifacts: memtriage

Allows you to quickly query a live Windows machine for RAM artifacts. This tool utilizes the Winpmem drivers to access physical memory, and Volatility for analysis. Caveats: Doesn’t work with Device Guard enabled. Should be tested on machines before deploying. Example Usage usage: memtriage.exe -...