UserDump

       UserDump is a microsoft tool that is able to generate a user dump of a process. The tool can be downloaded from http://support.microsoft.com/kb/241215. Support is also found on the same page.
To use userdump, we can run the following command "userdump [process id] Z:\[filename].dmp". The pre-requist for using this program is setting up a network drive from the victim machine to the forensics workstation we are using. To set up a shared drive, we can use "net use Z: \\[ip of forensics machine]\[folder name]".

To validate the dump files that we have created we will use a program named dumpchk.exe. A download link is found at: http://technet.microsoft.com/en-us/library/ee424340(v=ws.10).aspx. To use dumpchk, we run "dumpchk [name of file].dmp". This will display validation information about the dump file such as what product was used for the process (windows xp, nt, etc), and the modules that were ran.

Because these dump files can be fairly large, we can use a program from the PSTool Suite that will allow us to easily find strings. The program is coincidentally named Strings. To use we just run "strings [dump file].dmp".

Personal Remarks: Memory is always volitaile and a bit of a pandora's box when you are trying to capture it. Some of the time, capturing the memory of a process caused that process to crash. UserDump is a farily safe way to not mess with the entire memory and instead only grab a single process, which is far less space than the entire memory of a machine. These .dmp files, I've found, contain a LOT of spaghetti. That's where Strings comes in, since it can search that whole .dmp file and find a certain phrase or key input. These could be commands ran, or how the program was exectuted.