WindowsSCOPE2. Some systems cannot be shut down so live analysis is the only option. Live data can be captured and analyzed offline. 3. It is highly useful to collect information about the kernel, processes, registry…
read more
Washington DC, December 9-11. BlueRiSC team and academic collaborators present new direction for computing based on Bayesian inference and learning. It is one of the five presentations at the Rebooting Computing close-door meeting organized in…
read moreYou can access the video here.
read more
Pages are represented by Page Table Entries. A Page Table Entry is part of a virtual memory hierarchy. This hierarchy gives virtual to physical address mappings at the page granularity. From highest level to lowest,…
read more
To view the registry keys being used by Windows at the time of a snapshot, on the left panel go to Memory View → Summary of System Activity → Open Registry Keys. Open registry keys…
read moreYou can access the video here.
read moreWhen a process starts on an x86 (32-bit) system, it is given 4GB (232 = 4GB) of virtual memory. 4GB is a lot of memory and most processes don’t utilize the entire virtual memory space.…
read more
As an example, the FTP client FileZilla was used to create a local FTP server. Then, a computer on the same network attempted to connect to the server. A snapshot was taken on the host…
read more
In this screen shot, the example snapshot ‘Before Installing Antivirus’ is selected. The view is on Memory View → Summary of System Activity → Open Files, which is showing the Open Files for just the…
read moreYou can access the video here.
read more