[prev in list] [next in list] [prev in thread] [next in thread] 

List:       sleuthkit-users
Subject:    Re: [sleuthkit-users] Analyzing memory
From:       Brian Carrier <carrier () sleuthkit ! org>
Date:       2008-03-29 17:00:49
Message-ID: 439F03DA-AD46-4B71-895C-E8BBBDC1B0B0 () sleuthkit ! org
[Download RAW message or body]

Autopsy / TSK do not support memory analysis If you select RAW or  
SWAP then you will be only able to look at the raw data (in which  
case you may be better off with a hex editor).

brian


On Mar 28, 2008, at 4:52 PM, mark-wade@comcast.net wrote:
> Hello,
>
> I am analyzing memory that I got from another system.  During the  
> adding image portion of autopsy, do I select File System type as:  
> RAW, NFTS or SWAP?
>
> Thanks,
>
> Mark
> ---------------------------------------------------------------------- 
> ---
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/ 
> marketplace_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org


-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
[prev in list] [next in list] [prev in thread] [next in thread]