“It is a pure memory dump and can be used in conjunction with the page swap tables that are resident on disk to analyze and understand what is really running on a system.” “The memory is captured using low level memory read commands and brought back over the network to the forensic console” stated Chris Brown, Founder and CTO of Technology Pathways. These new capabilities will give CERT teams a new weapon in the battle against worms and Trojans that plague today’s networks. Once the memory is successfully imaged, the resulting image file may be searched for items of interest such as passwords, registry entries or evidence of malicious code. The image file, along with its hash signature may be added to the investigators report file for use later in court proceedings. The product suite is used in more than 70 countries in various high profile andĬomplex investigations involving cybercrime.(PRWEB) DecemTechnology Pathways announces the release of the latest version of ProDiscover Incident Response with a new capability to forensically image the memory of live systems via the network. It was one of the first products to support remote forensic capabilities. Launched in 2001, ProDiscover has a rich history. ProDiscover combines speed and accuracy, with ease of use and is available at an
Of tools and integrated viewers to explore the evidence disks and extract artifacts relevant to the investigation. Investigators are provided with a wide range
Wizards, dashboards and timeline views help in speedily discovering vital information. ProDiscover helps in efficiently uncovering files and data of interest. The product suite is also equipped with diagnostic and evidence collection tools for corporate policy compliance investigations and ProDiscover is widely used in Computer Forensics and Incident Response. ProDiscover forensics suite addresses a wide range of cybercrime scenarios encountered by law enforcement and corporate internal security investigators.
0 kommentar(er)
