search

Velocidex / WinPmem

The multi-platform memory acquisition tool.
Apache License 2.0
698 stars 102 forks source link

API collection as part of a default memory collection #1

Closed randomaccess3 closed 4 years ago

randomaccess3 commented 4 years ago

In addition to a memory image it would be good to get the data that you would require for any generic examination collected via the API in the same collection.

This will ensure that even if the memory collection is incomplete or damaged that there is potentially useful information collected already.

scudette commented 4 years ago

This is probably not the goal of this project - For more complete collections you can use Velociraptor and just include winpmem as one of the things to collect.