This is the winpmem documentation.
We currently release a simple imager which can only write RAW images. Simple run it with the name of the image file:
Three acquisition modes are implemented:
- PTE remapping mode - this is the default and is the most stable
- MMMapIoSpace mode - uses the MMMapIoSpace kernel API
- PhysicalMemory mode - passes a handle to the tradition
There is an issue board at https://github.com/Velocidex/WinPmem/issues