memdump - UNIX memory dumper

A prosperous 2004 to all! And here's a program that I wanted to
announce for a while but never got around to.

memdump is a utility that dumps main memory (/dev/mem) of UNIX
systems.  As documented in the memdump manual page this can be
trickier than one would expect at first sight.

What can you find in a system memory dump? Bits from the operating
system, from running processes, and from every file and directory
that has been accessed recently. Depending on the operating system
you may even find some information from deleted files and exited
processes, although that information tends to be short-lived.

Usage examples:

    memdump | nc host port
    memdump | openssl s_client -connect host:port

For best results send output off-host over the network. Writing to
a local file would clobber all the memory in the file system cache.
Use netcat, stunnel, or openssl, depending on your requirements.

With the exception of Linux, dumping UNIX system memory is a tricky
business because /dev/mem has holes that one has to carefully skip
around in order not to read nonsense or even miss information.

This utility will eventually be bundled with the Coroner's Toolkit,
but the attached version is stand-alone so that you can bundle it
easily with other tools. Tested on Linux, Solaris, FreeBSD, OpenBSD.

http://www.porcupine.org/forensics/memdump-1.0.tar.gz (source)
http://www.porcupine.org/forensics/memdump-1.0.tar.gz.sig (PGP)
http://www.porcupine.org/forensics/memdump-1.0.README (README)

	Wietse