System: Windows XP SP3 32bit
Physical RAM: 3GB
Page File (virtual): 4GB
Created backup image of the current state of memory (RAM) using dd (command below)
dd.exe if=\\.\PhysicalMemory of=C:\memorydump.img
Q1: This image file that dd created (snapshot of memory at the current state), is that memory physical RAM and Page File memory or just physical RAM? I used live CD Helix with dd.exe.
Q2: Now that I have this image file of memory, what tool can I use to analyze the contents. Maybe something like WindDbg or WinHex? If so, do you just open the image file into the program?