Mac Memory Reader is a simple command-line
utility to capture the contents of physical RAM on a suspect computer,
letting an investigator gather volatile state information prior to
shutting the machine down. Results are stored in a Mach-O binary file
for later off-line analysis by the investigator.
utility to capture the contents of physical RAM on a suspect computer,
letting an investigator gather volatile state information prior to
shutting the machine down. Results are stored in a Mach-O binary file
for later off-line analysis by the investigator.
Mac Memory Reader is available free of charge. It executes directly
on 32- and 64-bit target machines running Mac OS X 10.4, 10.5, or 10.6
and requires a PowerPC G4 or newer, or any Intel processor.
