Comments on: Reply to HBGary — and personal notes.

By: Matthieu Suiche

Matthieu Suiche — Sat, 23 Jan 2010 18:07:38 +0000

You have a problem with volatility not windd. Volatility does not support Vista 64bits.

Try again with:
win64dd.exe /d /f dump.dmp

/d option stands for Microsoft Crash Dump file.
and download Microsoft WinDbg and use it to load your dump.

By: De4d B0y

De4d B0y — Sat, 23 Jan 2010 00:17:48 +0000

First – I love windd – Your work is very much appreciated out here in fly-over country.

I’m having problems with win64dd (1.3) the latest version (from winter 2009) — I capture the RAM from a Vista SP2 64-bit machine with 4GB of RAM (or seem to) and save it as a .dd file. The size etc. looks good – But when I try to carve it with Volatility, I get many errors.

Has anyone opined on this? Maybe if I tried a different carving tool?

Any recommendations here?

Has anyone else had problems with win64dd and Vista?

Any help is much appreciated.

Thnx-
De4db0y

By: Tim

Tim — Thu, 14 Jan 2010 21:12:14 +0000

Matt-

Thanks for the wonderful product, I can say that through my testing, windd is the superior product out there right now, in many cases far superior.

Amazing that “correctness” is measured by “does the file load into our closed source tool?” in HBGary’s article!

Keep up the good work (and making the outproducts of your work available to us for free!).

now…off to buy one of these replica watches your other readers mention…

By: Term Papers

Term Papers — Mon, 07 Dec 2009 11:36:42 +0000

It is glad to see this blog, it is good and detailed fun to read this, nice informative blog, Thanks for share this article.

By: Andy Ward

Andy Ward — Mon, 16 Nov 2009 03:08:34 +0000

Very interesting article Matt.

I can vouch that during my beta testing last year, I recall you testing again pre releases of windows 7. I recall doing the same testing myself.

First or not, you were still up there with the “leaders” in this field. A great achievement.