SRA Memory Grabber Product Description

Agenda Memory Grabber Product Description Integrated Value Proposition Operational Need Hardware and Software Architecture Tethered and Un-Tethered operation Interfaces and Target Environment Integrated Value Proposition Partner Business Scenarios Next Steps

Memory Grabber Operational Need Currently, when law enforcement agents or Special Operations personnel seize a running laptop that is password protected, they have no way of capturing the potential valuable information resident in memory. Typically, they will power down the laptop and take it back to the rear or to a lab to perform forensic analysis on the hard drive losing all information associated with the current state of the machine (e.g. partially constructed documents or emails, web history, or any other information that gets permanently deleted upon power down). Law enforcement agents and Special Operations personnel need a tool that provides memory access to a running laptop in the field enabling the timely capture of volatile information.

System Concept The Memory Grabber system provides direct memory access to a running laptop via a small PC card (i.e. Memory Grabber device) that can be inserted into the external PCMCIA slot, similar to commercially-available external broadband network cards. The target laptop can be screen-locked and password-protected. The Memory Grabber system can be used in either tethered or un-tethered modes.

System Architecture

Specifications Parameter Express Card Card Bus Target Laptop OS Windows Linux Mac OS (32 bit and 64 bit versions) Operational Mode Tethered (USB) Un-Tethered (micro SD card) Data Integrity Available Yes Data Acquisition Speed (nominal) 8 Mbytes per sec 2 Mbytes per sec

Integrated Value Proposition HBGary Responder - Lowest Memory Footprint in the marketplace With SRA Memory Grabber – Even Lower (zero memory footprint, no software installed on target) Field and Lab versions with same toolset Lab: HBGary Responder Professional, SRA Memory Grabber (Express Card and Card Bus devices) Field: HBGary Responder Field, SRA Memory Grabber (Express Card and Card Bus devices) Provides quick look analysis in field as well as capability for very specific information acquisition missions

Target Environment Coverage HBGary Responder SRA Memory Grabber Windows Yes Linux No MacOS Future integration could provide market discriminating coverage of non-windows platforms.

Integrated Market Value Assume a law enforcement agency wishes to supply it’s forensic team with a memory forensic capability for use in the lab and in the field, including one lab facility and 1000 field personnel.

Next Steps Technical discussion on integration details Product exchange for evaluation / integration Data formatting to improve integration Candidate responder functionality to port to memory grabber device Business partnering discussion