Velocidex
Failed to Dump in AD based system
I am using this winpmem_mini_x64_rc2(1).exe and it work on formatted system but but it's not working properly on systems that are part of Active Directory (AD) or were previously joined to AD. @scudette
When you say not working properly, what do you mean? Does it load the driver at all? It's there any error in the log file?
When you say not working properly, what do you mean? Does it load the driver at all? It's there any error in the log file?
I am using properly and it works on fresh/formatted system but It is not working on AD based system , It dump the 0 kb file size and it fails to load the driver @scudette
Is there anything in the event log to suggest why the driver is not loading? Likely this is some policy enforced by group policy that prevents the driver from loading.
There is really not much we can do about that. It's really a windows security measure to prevent loading of drivers
No, there are no suggestions. If the driver is not loading due to a Windows security issue, then why does it work on a formatted/fresh system? I am using this command on a fresh system: "winpmem_mini_x64_rc2(1).exe sample.raw", and I am executing it in CMD with administrator privileges. @scudette
I would be looking for messages in the event log about why the driver didn't load. Additionally you can get debugging messages from the driver using debug view from sysinternals.
First establish if the driver can load at all using the -l flag. Then check if the memory address ranges returned are reasonable. The ranges are reported in the debug view output.
After you suggestion i ran this command "winpmem_mini_x64_rc2(1).exe -l sample.raw" in AD based system and i got this "WinPmem64 Extracting driver to C:\Users\Pardeep\AppData\Local\Temp\pme4F72.tmp Driver Unloaded. Deleting C:\Users\Pardeep\AppData\Local\Temp\pme4F72.tmp" @scudette
the -l flag just loads the driver but does not do any acquisition
You can see what is happening with dbgview
you can check the event log viewer to see the service is installed
If there is a security software of AD setting that prevents the driver from loading you will be able to see something in the event log
I tried but failed to get the information . In AD based system driver is not loaded .I got this WinPmem64 Extracting driver to C:\Users\Pardeep\AppData\Local\Temp\pme4F72.tmp Driver Unloaded. Deleting C:\Users\Pardeep\AppData\Local\Temp\pme4F72.tmp
If system is formatted and Not in AD .
WinPmem64 Extracting driver to C:\Users\Admin\AppData\Local\Temp\pme3E87.tmp Driver Unloaded. Loaded Driver C:\Users\Admin\AppData\Local\Temp\pme3E87.tmp. Deleting C:\Users\Admin\AppData\Local\Temp\pme3E87.tmp
could you tell why driver is not loading @scudette