tag:blogger.com,1999:blog-6447283518071683105.post7980114490502976316..comments2023-04-02T10:17:04.631-04:00Comments on Forensic Incident Response: Determining memory consumptionhogflyhttp://www.blogger.com/profile/00741773109962883616noreply@blogger.comBlogger8125tag:blogger.com,1999:blog-6447283518071683105.post-14597504377465434042007-07-19T09:10:00.000-04:002007-07-19T09:10:00.000-04:00Reading over your comment, it seems to me that thi...Reading over your comment, it seems to me that this discussion is going too far afield.<BR/><BR/>I still do not see how the number of pages 'consumed' by a process is particularly important, and I am concerned that the stated reason for measuring this is that because it can be measured.<BR/><BR/>I do agree that this is perhaps not the right venue for this discussion. I would suggest moving it toH. Carveyhttps://www.blogger.com/profile/08966595734678290320noreply@blogger.comtag:blogger.com,1999:blog-6447283518071683105.post-52835024498554019582007-07-19T08:07:00.000-04:002007-07-19T08:07:00.000-04:00I'm not sure that including a metric simply becaus...<I>I'm not sure that including a metric simply because (and for no other reason than) it is measurable, is the right way to go. Where's the science in that?</I><BR/><BR/>Ok, let me try to adapt. I'll use tool markings as an example to try to explain why I think this is of potential value. Please note I'm saying potential rather than absolute, because like you I am exploring what makes sense in hogflyhttps://www.blogger.com/profile/00741773109962883616noreply@blogger.comtag:blogger.com,1999:blog-6447283518071683105.post-2307824484608874852007-07-19T07:01:00.000-04:002007-07-19T07:01:00.000-04:00The point is to validate a tool that is used in li...<I>The point is to validate a tool that is used in live response, but was not designed for live response by determining what it does to a system upon execution.</I><BR/><BR/>Right, I hear you...but I'm still struggling with what about the tool that needs to be validated.<BR/><BR/><I>As memory consumption is measurable, I think it's pretty significant to include it, and to not do so, would lead toH. Carveyhttps://www.blogger.com/profile/08966595734678290320noreply@blogger.comtag:blogger.com,1999:blog-6447283518071683105.post-88956094676402548142007-07-18T22:40:00.000-04:002007-07-18T22:40:00.000-04:00Ok..why is this important.It's part of the impact ...Ok..why is this important.<BR/><BR/>It's part of the impact equation. <BR/><BR/>I'm not concerned with any particular process. I'm concerned with the process created upon execution of a tool used for live response that when executed will have an impact on a system.<BR/><BR/>You're right about new processes not being allocated memory used by currently active processes, but I don't think that's hogflyhttps://www.blogger.com/profile/00741773109962883616noreply@blogger.comtag:blogger.com,1999:blog-6447283518071683105.post-6345851098863319672007-07-18T17:42:00.000-04:002007-07-18T17:42:00.000-04:00Well, we can begin to narrow down just how much me...<I>Well, we can begin to narrow down just how much memory is actually being used by our process. </I><BR/><BR/>Okay...I guess the next question, then, is why is THIS important?<BR/><BR/><I>This actually looks at the process level...</I><BR/><BR/>Maybe I'm being dense (that's always possible) but I'm having a little trouble wrapping my brain around the fact that the amount of memory that a H. Carveyhttps://www.blogger.com/profile/08966595734678290320noreply@blogger.comtag:blogger.com,1999:blog-6447283518071683105.post-51283488604228075842007-07-18T16:40:00.000-04:002007-07-18T16:40:00.000-04:00Sorry Harlan, must have missed the first post. My...Sorry Harlan, must have missed the first post. <BR/><BR/>My understanding as it exists today, is that the process working set is the number of pages that are allocated for the process in physical memory. <BR/><BR/>Why is it important? Well, we can begin to narrow down just how much memory is actually being used by our process. We know the total amount (3084K in this case), and can now hogflyhttps://www.blogger.com/profile/00741773109962883616noreply@blogger.comtag:blogger.com,1999:blog-6447283518071683105.post-18416620449485090462007-07-18T10:13:00.000-04:002007-07-18T10:13:00.000-04:00Hogfly,Why is "consumption" important? What about...Hogfly,<BR/><BR/>Why is "consumption" important? What about this particular metric is of importance?H. Carveyhttps://www.blogger.com/profile/08966595734678290320noreply@blogger.comtag:blogger.com,1999:blog-6447283518071683105.post-76454002521140167602007-07-16T07:38:00.000-04:002007-07-16T07:38:00.000-04:00Why is "consumption" important?Why is "consumption" important?H. Carveyhttps://www.blogger.com/profile/08966595734678290320noreply@blogger.com