rootkit.com

main menu

forums
Show me new threads!

vault

you must be level 2 to upload files to your vault

downloads

you must be logged to access downloads

Rootkit Collection

short description	Windows Memory Forensic Toolkit (WMFT) is a collection of utilities intended for forensic use. WMFT can be used to perform forensic analysis of physical memory images acquired from Windows 2003/XP machines.
long description:	Windows Memory Forensic Toolkit is used to perform offline analysis of a physical memory. This is utility intended mainly for forensic-related investigative use. Current version can be used: to enumerate processes (linked by doubly linked list) and processes hidden by DKOM, to display detailed data about each process (e.g. info from access_token, data section control areas), to enumerate page frames which belongs to each process and to identify a process to which any Page Frame Number belongs.
project leader:	alcapone666
homepage:	http://strony.aster.pl/forensics/
changelog:
download:	link

post a message
Show all posts in this forum

view options: unpacked threads | collapsed threads | old style view

how many threads to display:

search board (text+titles):

subject	author	date	last post		nr. of posts
Writing to physical memory	vmukhi	Mar/20, 09:18	Jan/18, 00:02		3

Truth is what stands the test of experience.