March 14, 2023, 6:50 a.m. | /u/PityDaFool69

Computer Forensics www.reddit.com

I have a test setup of Velociraptor.

It's simply a Linux based server and a Windows 11 client.

I can get some queries running on the client, but the built-in "Windows.Memory.Acquisition" does never finish. When I download the artefact (.zip), I get a bunch of empty files. The included log file has as a last line:

"shell: Running external command \[C:\\Program Files\\Velociraptor\\Tools\\winpmem\_mini\_x64\_rc2.exe C:\\Program Files\\Velociraptor\\Tools\\tmp3451188904.raw\]"

It seems like it doesn't even start the memdump, but I am not sure if / …

acquiring acquisition client command computerforensics download external file files linux log memory program server shell start test tools velociraptor windows windows 11 winpmem zip

Sr Cyber Threat Hunt Researcher

@ Peraton | Beltsville, MD, United States

Lead Consultant, Hydrogeologist

@ WSP | Chattanooga, TN, United States

Senior Security Engineer - Netskope/Proofpoint

@ Sainsbury's | London, London, United Kingdom

Senior Technical Analyst-Network Security

@ Computacenter | Bengaluru Bengaluru (Bengaluru, IN, 560025

Senior DevSecOps Engineer - Clearance Required

@ Logistics Management Institute | Remote, United States

Software Test Automation Manager - Cloud Security

@ Tenable | Israel - Office - CS