windows memory analysis
Andreas Schuster recently published on his blog two interesting articles about process memory reconstruction.
He describes how to extract the memory of a single process from a full memory dump. The other article shows how to reconstruct a program binary of a specific process from a full memory dump.
