1. SRA Memory Grabber
Product Description

2. Agenda Memory Grabber Product Description Integrated Value Proposition
Operational Need
Hardware and Software Architecture
Tethered and Un-Tethered operation
Interfaces and Target Environment
Integrated Value Proposition
Partner Business Scenarios
Next Steps

3. Memory Grabber Operational Need
Currently, when law enforcement agents or Special Operations personnel seize a running laptop that is password protected, they have no way of capturing the potential valuable information resident in memory. Typically, they will power down the laptop and take it back to the rear or to a lab to perform forensic analysis on the hard drive losing all information associated with the current state of the machine (e.g. partially constructed documents or s, web history, or any other information that gets permanently deleted upon power down).
Law enforcement agents and Special Operations personnel need a tool that provides memory access to a running laptop in the field enabling the timely capture of volatile information.

4. System Concept
The Memory Grabber system provides direct memory access to a running laptop via a small PC card (i.e. Memory Grabber device) that can be inserted into the external PCMCIA slot, similar to commercially-available external broadband network cards. The target laptop can be screen-locked and password-protected. The Memory Grabber system can be used in either tethered or un-tethered modes.

5. System Architecture

6. Specifications Parameter Express Card Card Bus Target Laptop OS
Windows
Linux
Mac OS
(32 bit and 64 bit versions)
Operational Mode
Tethered (USB)
Un-Tethered (micro SD card)
Data Integrity Available
Yes
Data Acquisition Speed (nominal)
8 Mbytes per sec
2 Mbytes per sec

7. Integrated Value Proposition
HBGary Responder - Lowest Memory Footprint in the marketplace
With SRA Memory Grabber – Even Lower (zero memory footprint, no software installed on target)
Field and Lab versions with same toolset
Lab: HBGary Responder Professional, SRA Memory Grabber (Express Card and Card Bus devices)
Field: HBGary Responder Field, SRA Memory Grabber (Express Card and Card Bus devices)
Provides quick look analysis in field as well as capability for very specific information acquisition missions

8. Target Environment Coverage
HBGary Responder
SRA Memory Grabber
Windows
Yes
Linux No
MacOS
Future integration could provide market discriminating coverage of non-windows platforms.

9. Integrated Market Value
Assume a law enforcement agency wishes to supply it’s forensic team with a memory forensic capability for use in the lab and in the field, including one lab facility and 1000 field personnel.

10. Next Steps Technical discussion on integration details
Product exchange for evaluation / integration
Data formatting to improve integration
Candidate responder functionality to port to memory grabber device
Business partnering discussion