Top Posters
Since Sunday
5
o
5
4
m
4
b
4
x
4
a
4
l
4
t
4
S
4
m
3
s
3
New Topic  
billyhilly billyhilly
wrote...
Posts: 479
4 years ago

Why is it that most conventional applications are incapable of copying live memory from a computer system?



▸ They're not incapable. It's easy to capture memory.

▸ Because memory is constantly shifting. The mere fact that you are copying the memory causes it to change.

▸ Because direct access to system memory requires a kernel-mode procedure call. Most applications only have user-mode access.

▸ Because system memory is not part of the regular file system.
Textbook 
Digital Archaeology: The Art and Science of Digital Forensics

Digital Archaeology: The Art and Science of Digital Forensics


Edition: 1st
Author:
Read 185 times
1 Reply
Replies
Answer verified by a subject expert
coltonf1coltonf1
wrote...
Posts: 392
4 years ago
Sign in or Sign up in seconds to unlock everything for free
More solutions for this book are available here
1

Related Topics

billyhilly Author
wrote...

4 years ago
Brilliant
wrote...

Yesterday
This helped my grade so much Perfect
wrote...

2 hours ago
Just got PERFECT on my quiz
New Topic      
Explore
Post your homework questions and get free online help from our incredible volunteers
  944 People Browsing
Related Images
  
 1058
  
 43
  
 11826
Your Opinion
Where do you get your textbooks?
Votes: 284