|
Products
|
|
 |
|
 |
|
|
|
|
|
Acquire Active Memory Processes
It's every examiner's dream to be able to acquire active memory from a machine.
In most forensic examinations, this simply isn't possible. With P2 Enterprise and
P2 Shuttle Pro, you can not only acquire active memory processes, you can
start or kill any process on demand, view screenshots, view associated files with running processes and much more with the System Runtime Explorer. The SRE gives you more control than you imagined from a forensic tool. If you see a malicious process, you can shut down the machine manually or use the P2 Enterprise Telnet client to kill processes or shut down the system before it does any more damage to your enterprise. If you need to access all saved passwords on the suspect machine, the SRE allows you do to this. The evidence you can gather from active
memory processes may never actually be saved to the hard drive so it may be your
only chance at the smoking gun.
|
|
|
System Runtime Explorer Features
|
|
View All Active Processes
|
|
|
Acquire Any or All Active Processes
|
|
|
View all DLLs and Executables Associated with Running Processes
|
|
|
View All Files Currently in Use by Processes
|
|
|
View Protected Storage: Lists all Saved Usernames and Passwords
|
|
|
View Selected Process Memory in the Hex Viewer
|
|
|
View All Associated Registry Keys
|
|
|
|
|
 |
|
 |
|
|
|
|
