Generated by All in One SEO v4.9.8, this is an llms.txt file, used by LLMs to index the site.

# WindowsSCOPE

Memory Forensics Tools | Incident Response

## Sitemaps

- [XML Sitemap](https://www.windowsscope.com/sitemap.xml): Contains all public & indexable URLs for this website.

## Posts

- [Reverse Engineering the Vanquish Rootkit - Part 2](https://www.windowsscope.com/reverse-engineering-the-vanquish-rootkit-part-2/) - If you followed our prior post on the Vanquish rootkit, you might remember how we identified anomalies in a system that led us to finding a Vanquish rootkit infection. You can go back to Part 1 and review it on your own, but here is a quick summary of how we discovered the rootkit: Found
- [WindowsSCOPE Cyber Forensics 3.2 Now Available](https://www.windowsscope.com/windowsscope-cyber-forensics-ultimate-64-bit-now-availalble-2/) - A new version of WindowsSCOPE Cyber Forensics is now available. WindowsSCOPE version 3.2 now includes support for the latest versions of Windows operating systems through Windows 10. Also included with version 3.2 is WindowsSCOPE's data search tool. Use it to find URLs, credit cards, email addresses, phone numbers, and other digital forensic artifacts hidden memory.
- [WindowsSCOPE Cyber Forensics Ultimate 64-Bit Now Available](https://www.windowsscope.com/windowsscope-cyber-forensics-ultimate-64-bit-now-availalble/) - The latest addition to the WindowsSCOPE product lineup, Cyber Forensics Ultimate, is now available at the online store. This new version incorporates all the interactive features of previous versions, including system-wide disassembly and control flow graphing of both user and kernel space. The 64-bit version enables support for importing memory dumps taken from any 64-bit
- [Official WindowsSCOPE Launch](https://www.windowsscope.com/official-windowsscope-launch/) - Amherst, MA, March 16, 2011 - BlueRiSC Inc. announces the official launch of WindowsSCOPE, a sophisticated and must-have tool to fully understand and analyze Windows machines―your "Window into Windows.” Various versions of the tool target students and hobbyists,
- [Introduction to WindowsSCOPE - a Tutorial Video](https://www.windowsscope.com/introduction-to-windowsscope-a-tutorial-video/) - You can access the video here.
- [Introduction to 64-Bit Virtual Memory Management Video](https://www.windowsscope.com/introduction-to-64-bit-virtual-memory-management-video/) - You can access the video here.
- [Rootkit Video Series: Understand and Detect the Shadow Walker Rootkit](https://www.windowsscope.com/rootkit-video-series-shadow-walker/) - You can access the video here.
- [Introduction to 32-Bit Virtual Memory Management](https://www.windowsscope.com/introduction-to-32-bit-virtual-memory-management/) - You can access the video here.
- [Introduction to Windows Kernel: Review IDT, SSDT and other Structures](https://www.windowsscope.com/introduction-to-windows-kernel/) - You can access the video here.
- [Bypassing Windows Login Passwords with CaptureGUARD Gateway for Forensic Acquisition](https://www.windowsscope.com/bypassing-windows-login-passwords-with-captureguard-gateway-for-forensic-acquisition-2/) - Live memory acquisition is becoming increasingly important for digital investigations. One of the biggest obstacles with memory acquisition, however, is that in many cases a computer under investigation is locked, requiring a password that is not available. CaptureGUARD Gateway enables investigators to overcome this challenge by allowing them to log into a computer without knowing
- [New WindowsSCOPE Memory Forensics Training Videos Available](https://www.windowsscope.com/new-windowsscope-memory-forensics-training-videos-available/) - Two new tutorial videos are now publicly available on the WindowsSCOPE websiite - "Using WindowsSCOPE to Investigate 64-Bit Virtual Memory Management" and "Using WindowsSCOPE to Analyze the Shadow Walker Rootkit". With 64-bit computers becoming increasingly common, the Introduction to 64-Bit Virtual Memory Management video will bring you up to speed on how Windows memory management
- [Virtual Memory and Address Translating for x86 and x86 PAE](https://www.windowsscope.com/virtual-memory-and-address-translating-for-x86-and-x86-pae/) - When a process starts on an x86 (32-bit) system, it is given 4GB (232 = 4GB) of virtual memory. 4GB is a lot of memory and most processes don’t utilize the entire virtual memory space. Memory is broken up into pages of 4KB (212 = 4KB). This gives each process access to 220 pages (232
- [Virtual Memory and Address Translating for x64](https://www.windowsscope.com/virtual-memory-and-address-translating-for-x64/) - Pages are represented by Page Table Entries. A Page Table Entry is part of a virtual memory hierarchy. This hierarchy gives virtual to physical address mappings at the page granularity. From highest level to lowest, the hierarchy looks like this: Page Map Level →Page Directory Pointers → Page Directories →Page Tables →Page Table Entries Every
- [Reverse Engineering the Vanquish Rootkit - Part 1](https://www.windowsscope.com/reverse-engineering-the-vanquish-rootkit-part-1/) - The first warning sign that we noticed in this snapshot was in the process for cmd.exe (this is for a Windows command line window). See below for a screenshot of the contents of this process:
- [Review all Open Files Accessed by Processes in Memory](https://www.windowsscope.com/open-files/) - 'Process' is the process that is using a selected entry, 'File Name' is the file or folder being used, and 'Access Rights' is what permissions the process has. One thing to note is that the starting directory is assumed to be the main drive on the computer, typically 'Local Disk (C:)'. From the example snapshot,
- [Comparing Open Network Sockets](https://www.windowsscope.com/comparing-open-network-sockets/) - As an example, the FTP client FileZilla was used to create a local FTP server. Then, a computer on the same network attempted to connect to the server. A snapshot was taken on the host computer once the server was up and running, but before any connections were made to the server. Another snapshot was
- [How to Compare Multiple Memory Snapshots](https://www.windowsscope.com/compare/) - In this screen shot, the example snapshot 'Before Installing Antivirus' is selected. The view is on Memory View → Summary of System Activity → Open Files, which is showing the Open Files for just the current snapshot. To compare this list to a list from another snapshot, check the box for the snapshots that are
- [Check Open Registry Keys in Memory](https://www.windowsscope.com/open-registry-keys/) - To view the registry keys being used by Windows at the time of a snapshot, on the left panel go to Memory View → Summary of System Activity → Open Registry Keys. Open registry keys can be viewed per process as well by going to Memory View → Processes → Open Registry Keys. From
- [Automated Rootkit Detection with ThreatSCOPE](https://www.windowsscope.com/automated-rootkit-detection-with-threatscope/) - This article will show how you can use the ThreatSCOPE feature of WindowsSCOPE to detect rootkits installed on a system. One of the difficulties in detecting rootkits and other advanced malware is that they’re often packed, encrypted, or injected by other means than being run from an executable file on the disk. This means they
- [New WindowsSCOPE Product - CaptureGUARD Gateway](https://www.windowsscope.com/new-windowsscope-product-captureguard-gateway/) - WindowsSCOPE now offers PCI Express and ExpressCard platforms capable of imaging physical memory and providing other cyber security related capabilities even in locked computers. CaptureGUARD Gateway can be customized for various advanced cyber security and forensics use-cases not possible with other solutions on the market. Please contact us at support@windowsscope.com to explore how these capabilities
- [Introduction to WindowsSCOPE Live](https://www.windowsscope.com/introduction-to-windowsscope-live/) - Step 1 – Setting up your WindowsSCOPE Live Server The first step in getting WindowsSCOPE Live running is to download and install the WindowsSCOPE Live server. You can get the server on the WindowsSCOPE downloads page, here, after registering. To install WindowsSCOPE Live Server, simply run the installer and follow the steps. Then run the
- [Top Ten Reasons to Perform Live Memory Forensics Collection](https://www.windowsscope.com/top-ten-reasons-to-perform-live-memory-forensics-collection/) - 2. Some systems cannot be shut down so live analysis is the only option. Live data can be captured and analyzed offline. 3. It is highly useful to collect information about the kernel, processes, registry and file accesses, as well as, network communications and their associations. Suspicious processes and their activity can be tracked. WindowsSCOPE
- [How to Capture/Analyze Network Activities from Memory](https://www.windowsscope.com/how-to-captureanalyze-network-activities-from-memory/) - Any network connection can then be examined. For example, take a closer look at the Firefox connection in the example snapshot that has a 'Destination' 74.125.93.105:80. This means that the process is accessing the IP Address 74.125.93.105 using Port 80 by means of TCP. In addition to viewing a summary of the network activity,
- [Review and capture Import and Export Address Tables from Memory](https://www.windowsscope.com/review-and-capture-import-and-export-address-tables-from-memory/) - What is a DLL: A DLL (Dynamic-Link Library) can be thought of as a library of code and data that can be used by many programs at once. Essentially, it contains functions that can be called by portable executables. Utilizing a DLL has many advantages. It saves the programmer time from having to write code
- [Windowsscope Blog introduced](https://www.windowsscope.com/windowsscope-blog-introduced-1/) - WindowsSCOPE is a tool to learn and analyze the internals of the Windows operating system and everything it runs. Use it to learn to master operating systems, the Windows kernel, virtual memory management, x86 memory management, device drivers and applications. Use it to access the kernel, disassemble and graph any code in the kernel or
- [Phantom Probe Agent Launched for WindowsSCOPE](https://www.windowsscope.com/phantom-probe-agent-launched-for-windowsscope/) - Amherst, MA, April 4, 2011 - BlueRiSC enhances its WindowsSCOPE™ reverse-engineering, cyber analysis and defense, and memory forensics tool suite by adding the ability to analyze any computer on a network or Cloud transparently through its industry-unique Phantom Probe Agent™ technology.
- [Rebooting Computing](https://www.windowsscope.com/rebooting-computing-br/) - Washington DC, December 9-11. BlueRiSC team and academic collaborators present new direction for computing based on Bayesian inference and learning.

## Pages

- [Home](https://www.windowsscope.com/) - Windows Memory Forensics & Incident Response Tools, Accessories & Solutions WindowsSCOPE is an incident response tool which enables memory forensics for Windows computers. It performs reverse-engineering of the entire operating system from physical memory as well as all running software. It automatically identifies all processes, threads, and drivers running on the system as well as
- [WindowsSCOPE Cyber Forensics 3.3](https://www.windowsscope.com/windowsscope-cyber-forensics/) - WindowsSCOPE is a windows memory forensics tool which enables memory capture, memory dump import, and analysis of all running software or malware on the system.
- [Try It](https://www.windowsscope.com/try-it/) - Trial of the WindowsSCOPE memory forensics tool. Performs reverse engineering of memory dumps from Windows computers enabling analysis and incident response.
- [Videos](https://www.windowsscope.com/videos/) - These videos are provided to help familiarize you with the features of WindowsSCOPE and CaptureGUARD accessories. Use these video demonstrations together with the quick start guide to quickly learn your way around. New Users should start with the introduction video. Once you’ve learned the basics of WindowsSCOPE you could move on to the more advanced
- [Products](https://www.windowsscope.com/products/) - WindowsSCOPE Products include the WindowsSCOPE memory forensics tool and hardware accessories for memory capture and access to locked computers.
- [CaptureGUARD Physical Memory Acquisition Hardware – ExpressCard](https://www.windowsscope.com/captureguard-physical-memory-acquisition-hardware-expresscard/) - CaptureGUARD is an ExpressCard for memory capture from a Windows computer. Memory dump files can be analyzed with WindowsSCOPE and other memory forensics tools.
- [CaptureGUARD Physical Memory Acquisition Hardware – PCIe Add-on](https://www.windowsscope.com/captureguard-physical-memory-acquisition-hardware-pcie-add-on/) - CaptureGUARD is a PCI Express card for memory capture from a Windows computer. Memory dumps can be analyzed with WindowsSCOPE and other memory forensics tools.
- [WindowsSCOPE Phantom Probe USB Dongle](https://www.windowsscope.com/windowsscope-phantom-probe-usb-dongle/) - The WindowsSCOPE Phantom Probe dongle performs memory capture and provides storage for memory dumps. Memory dumps can be imported into WindowsSCOPE for analysis
- [WindowsSCOPE Forensic Archiving Appliance](https://www.windowsscope.com/windowsscope-forensic-archiving-appliance/) - A high performance forensic appliance capable of performing network-wide live memory forensics, forensic archiving and incident response.
- [Incident Response](https://www.windowsscope.com/incident-response/) - WindowsSCOPE memory forensics tools provide memory analysis and search features which can identify digital artifacts related to sophistacted cyber threats.
- [Reverse Engineering](https://www.windowsscope.com/reverse-engineering/) - WindowsSCOPE performs reverse engineering of Windows memory dumps enabling analysis of malware including sophisticated polymorphic malware.
- [Law Enforcement](https://www.windowsscope.com/law-enforcement/) - WidnowsSCOPE memory forensics tools enable law enforcement to capture and analyze Windows memory dumps and identify programs running at the time of acquisition.
- [Education](https://www.windowsscope.com/education/) - WindowsSCOPE and CaptureGUARD accessories offer hands-on learning for Incident Response and Law Enforcement. The WindowsSCOPE team offers training sessions.
- [CaptureGUARD Gateway – Access to Locked Computers](https://www.windowsscope.com/captureguard-gateway-access-to-locked-computers/) - CaptureGuard Gateway is an ExpressCard that enables access to locked Windows computers and enables live forensics, incident response and memory capture
- [Company](https://www.windowsscope.com/company/) - Founded in 2002, we invent cutting-edge system assurance solutions for the 21st century with novel software and hardware designs focusing on security technologies that can be game changing. WindowsSCOPE is a division within BlueRiSC Inc. BlueRISC also includes EPRIVO, a consumer private email service and digital privacy solution brand at eprivo.com.
- [Contact](https://www.windowsscope.com/contact/) - Your Name (required) Your Email (required) Subject Message
- [Privacy Policy](https://www.windowsscope.com/privacy-policy/) - What information do we collect? We collect information from you when you register on our site, place an order or fill out a form. When ordering or registering on our site, as appropriate, you may be asked to enter your: name, e-mail address, mailing address, phone number or credit card information. You may, however, visit
- [Forensics Tool Screen Shots](https://www.windowsscope.com/forensics-tool-screen-shots/)
- [Store](https://www.windowsscope.com/store/) - CaptureGUARD Gateway – Access to Locked Computers $9,199 Add to cart CaptureGUARD Physical Memory Acquisition Hardware – ExpressCard $7,799 Add to cart CaptureGUARD Physical Memory Acquisition Hardware – PCIe Add-on $9,599 Add to cart WindowsSCOPE 3.3 Cyber Forensics Tools $9,199 – $19,499Price range: $9,199 through $19,499 Select options WindowsSCOPE Cyber Forensics 3.3 Trial $1 Add
- [Blog](https://www.windowsscope.com/blog/) - WindowsSCOPE Cyber Forensics 3.2 Now Available WindowsSCOPE Cyber Forensics 3.2 Now Available https://www.windowsscope.com/wp-content/themes/corpus/images/empty/thumbnail.jpg 150 150 BlueRiSC BlueRiSC https://secure.gravatar.com/avatar/8f82e2ceb721c41f269d91ce44577d8ae0084c2bb4de9050048552b4f9b71c30?s=96&d=mm&r=g August 15, 2017 September 26, 2017 By: BlueRiSC August 15, 2017 A new version of WindowsSCOPE Cyber Forensics is now available. WindowsSCOPE version 3.2 now includes support for the latest versions of Windows operating systems through Windows
- [Quick Start Guide](https://www.windowsscope.com/quick-start-guide/) - All the information needed to get you started with cyber defense, cyber analysis and/or memory forensics is covered in the WindowsSCOPE Quick Start Guide. Among other things, it describes how to use the tool to access OS structures, investigate your system, and compare snapshots. WindowsSCOPE Cyber Forensics - Quick Start Guide
- [Markets](https://www.windowsscope.com/markets/)
- [WindowsSCOPE](https://www.windowsscope.com/windowsscope/) - WindowsSCOPE 3.3 Cyber Forensics Tools
- [Partners](https://www.windowsscope.com/partners/) - WindowsSCOPE delivers a profitable partnership with unique business opportunities, free access to WindowsSCOPE resources and tools, and differentiated market resources for its Partners. It rewards it’s Partner’s strong commitment by actively ensuring their best interest. Partnership benefits accelerate as WindowsSCOPE partners show commitment and acquire the necessary expertise in selling and providing value add to
- [Support](https://www.windowsscope.com/support/) - We at BlueRiSC are delighted to provide you with support and encourage you to contact us would you have issues or technical questions. Customers can flag questions that are highly technical so that we can direct them to developers immediately cutting down on the cycle to get adequate level of depth into the response. We

## Posts

- [seedprod](https://www.windowsscope.com/seedprod/sp-cs/)

## Products

- [WindowsSCOPE 3.3 Cyber Forensics Tools](https://www.windowsscope.com/product/windowsscope-cyber-forensics/) - A GUI-based memory forensic capture and analysis toolkit. Allows for the import of standard WinDD memory dumps which are then automatically reverse engineered and presented in an easy-to-view format for forensic analysis in a central location. For international orders (outside of United States), please contact info@windowsscope.com
- [WindowsSCOPE Cyber Forensics 3.3 Trial](https://www.windowsscope.com/product/windowsscope-cyber-forensics-trial/) - WindowsSCOPE is the next generation in memory forensics and cyber-attack fingerprinting technology for Microsoft Windows. To learn more, download the whitepaper or try the tool directly. You can also request a live demonstration at busdev@windowsscope.com . First-time users can try the full-featured 3-day trial version of WindowsSCOPE. Contains support for Windows XP, Windows Vista, Windows 7, Windows 8/8.1, and Windows 10 WinDD compatible memory dumps. For other operating systems and to request a demonstration contact support@windowsscope.com. The $1 license fee is required so that we can validate users and prevent fraudulent use of WindowsSCOPE. The WindowsSCOPE Trial requires the completion of a brief online survey within 48 hours after expiration of the trial. Option 1 Try WindowsSCOPE Cloud version at BlueRiSC Store (just select trial version, create account, and checkout). Easy to use Pre-installed with latest version of WindowsSCOPE (no setup or license file required) Can be accessed from any computer (Windows/macOS) Try Cloud Rental Option 2 Try node-locked version by following these steps: Add this trial license to your cart using the "Add To Cart" button below and check out. A download link will be emailed to you following your purchase. We will contact you shortly after purchasing to provide a license file for your WindowsSCOPE trial as well as a link to the required, brief survey. By proceeding with purchase you agree to completing the brief online survey within 48 hours of expiration.
- [CaptureGUARD Gateway - Access to Locked Computers](https://www.windowsscope.com/product/captureguard-gateway-access-to-locked-computers/) - This is an ExpressCard platform that enables access to locked Windows computers allowing live forensic acquisition/analysis in these otherwise inaccessible systems. Watch the video demonstration of CaptureGUARD Gateway bypassing Windows login passwords. For international orders (outside of United States), please contact info@windowsscope.com
- [CaptureGUARD Physical Memory Acquisition Hardware - ExpressCard](https://www.windowsscope.com/product/captureguard-physical-memory-acquisition-hardware-expresscard/) - This is an ExpressCard device capable of imaging the physical memory of the computer it's connected to. Creates dump files in the standard WinDD format that can be used with WindowsSCOPE Cyber Forensics Ultimate or with other WinDD compatible dump analysis tools. For international orders (outside of United States), please contact info@windowsscope.com
- [CaptureGUARD Physical Memory Acquisition Hardware - PCIe Add-on](https://www.windowsscope.com/product/captureguard-physical-memory-acquisition-hardware-pcie-add-on/) - This is a PCI Express add-on device capable of imaging the physical memory of the computer it's connected to. Creates dump files in the standard WinDD format that can be used with WindowsSCOPE Cyber Forensics Ultimate or with other WinDD compatible dump analysis tools. For international orders (outside of United States), please contact info@windowsscope.com
- [WindowsSCOPE Phantom Probe USB Dongle](https://www.windowsscope.com/product/windowsscope-phantom-probe-usb-dongle/) - A USB 3.0 dongle containing the WindowsSCOPE Phantom Probe that complements WindowsSCOPE Cyber Forensics products. This dongle runs the WindowsSCOPE Phantom Probe Agent capable of capturing a WindowsSCOPE snapshot from any supported Windows computer when plugged in. For international orders (outside of United States), please contact info@windowsscope.com
- [WindowsSCOPE Forensic Archiving Appliance](https://www.windowsscope.com/product/windowsscope-forensic-archiving-appliance/) - A high performance forensic appliance capable of performing network-wide live memory forensics, forensic archiving and incident response. Through the use of the WindowsSCOPE Cyber Forensics - Appliance, with TBs of storage, the solution is able to periodically collect live memory (snapshots/dumps) network-wide from each node, fully reverse engineer and archive them, and perform sophisticated analyses tracking changes in time and across nodes. Get a Quote

## Testimonial Items

- [Mayan Mathen - CTO NTT Innovation Institute Inc.](https://www.windowsscope.com/testimonial/mayan-mathen-cto-ntt-innovation-institute-inc/) - "BlueRiSC's approach looks very appealing due to its innovative approach on the problem of healing security vulnerabilities in software without requiring human intervention." Mayan Mathen - CTO NTT Innovation Institute Inc.
- [David Crow - Founder/CEO Tucson Embedded Systems](https://www.windowsscope.com/testimonial/david-crow-founderceo-tucson-embedded-systems/) - "One unique benefit of the (BlueRiSC's) solution is that it addresses multiple classes of software vulnerabilities, including silent vulnerabilities that don't alter system state. To our knowledge there is no approach that captures silent vulnerabilities and BlueRiSC's solution looks very promising since it has deep and fundamental underpinnings that can become game changing for not
- [Sheila M Walker](https://www.windowsscope.com/testimonial/sheila-m-walker/) - “It is our organizations belief that [BlueRiSC] solutions will have significant positive impact on the security market by enhancing and expanding on the functionality and features currently defined by the Trusted Computing Group standards.” Sheila M Walker, VP of Business Development, Ntru Cryptosystems
- [Dr Elena Trichina](https://www.windowsscope.com/testimonial/dr-elena-trichina-2/) - “In my view, BlueRiSC’s security approach is truly unique and extremely innovative. …. [S]ecurity is not added as an afterthought, as is the case with so many products today, but rather as part of an integrated, well-thought-out approach at both the software and hardware levels.” Dr Elena Trichina, Security Expert, Senior Member of Technical Staff
- [Rob Scott](https://www.windowsscope.com/testimonial/rob-scott/) - “As the need for secure processing will only continue to increase …, we believe that if BlueRiSC continues its progress this technology could become very important in this segment.” Rob Scott, Manager New Technology Sourcing, Nokia
- [Dr Elena Trichina](https://www.windowsscope.com/testimonial/dr-elena-trichina/) - “The company’s ability to offer complete solutions, including the firmware and tools, is impressive.” Dr Elena Trichina, Security Expert, Senior Member Technical Staff System Hardware, Spansion
- [Raytheon](https://www.windowsscope.com/testimonial/raytheon/) - "This (BlueRiSC's UniQore processor suite) is a per-program unique or per-device unique instantiation of a tamper-resilient secure soft-core processor; a very interesting and innovative prospect." Raytheon

## Categories

- [News](https://www.windowsscope.com/category/news/)
- [General](https://www.windowsscope.com/category/general/)
- [Tutorial videos](https://www.windowsscope.com/category/tutorial-videos/)
- [Use Cases](https://www.windowsscope.com/category/use-cases/)
- [Products](https://www.windowsscope.com/category/products/)

## Product categories

- [WindowsSCOPE](https://www.windowsscope.com/product-category/windowsscope/)
- [Memory Forensics](https://www.windowsscope.com/product-category/memory-forensics/)
- [Cyber Forensics](https://www.windowsscope.com/product-category/cyber-forensics/)
- [Tool](https://www.windowsscope.com/product-category/tool/)
- [Memory Fetch](https://www.windowsscope.com/product-category/memory-fetch/)
- [Appliance](https://www.windowsscope.com/product-category/appliance/)
- [Network](https://www.windowsscope.com/product-category/network/)
- [Accessory](https://www.windowsscope.com/product-category/accessory/)
- [Locked Computers](https://www.windowsscope.com/product-category/locked-computers/)

## Testimonial Categories

- [General](https://www.windowsscope.com/testimonial_category/general/)