Windows 2000 32Bit ,SP4

Question

Windows 2000 32Bit ,SP4

HaroldFi opened this issue 8 years ago · comments

I know this OS version is very old, but i need this profile so badly.
I didn't find anyone requesting this profile on google.
Please advise how to find this profile

gleeda (Jamie Levy) · Answer 1 · Mon Jun 06 2016 05:13:16 GMT+0800 (China Standard Time)

You will need to build a profile for this OS, using the ntoskrnl from disk. You will also have to make some modifications in order to get things to work with Volatility. I may be able to help you with this, if I have some spare time.

You can also try to use PTFinder [1][2], which carves out some items for Windows 2000.

[1] http://computer.forensikblog.de/en/2007/11/ptfinder-version-0305.html

[2] http://computer.forensikblog.de/en/2008/11/ptfinder-for-windows-vista.html

Daniel A. Melo · Answer 2 · Mon Mar 12 2018 11:08:15 GMT+0800 (China Standard Time)

Hi @HaroldFi , did you get it?

[]´s

debernal · Answer 3 · Wed Nov 14 2018 01:35:29 GMT+0800 (China Standard Time)

Hello, I want to do the same as HaroldFI, Is there any existing documentation or manual on how to create a profile using the ntoskrnl from disk? Thanks