Tools like macquisition can assist examiners in acquiring ram from mac computers.
Mat memory analyzer mac os x.
Swt cannot be used with os x jre version 1 6 mac osx only os x jre version 1 6 assumes that pointers have a size of 64 bits but swt s carbon port only uses 32 bit pointers so swt and eclipse cannot be used with os x jre version 1 6.
As long as the user has logged in as an administrator a memory capture tool can be run.
Memoryanalyzer the eclipse memory analyzer is a fast and feature rich java heap analyzer that helps you find memory leaks and reduce memory consumption.
If you are running the memory analyzer inside your eclipse sdk you need to edit the eclipse ini file.
The workaround is to use an earlier supported version of the os x jre.
The stand alone memory analyzer is based on eclipse rcp.
In addition the memory can be dumped in different formats using different offsets and this may make some investigating tools useless.
If you run a 64bit vm then all native parts also must be 64bit.
Hex editors string extraction tools search tools and file carvers are all useful for extracting data.
The chart feature requires the birt chart engine version 2 3 0 or greater.
It is also common to zip core dumps because they are so large and compress.
To run activity monitor open the utilities folder in your applications folder.
Collecting and analyzing ram on a mac is not surprisingly different than it is on a windows machine.
Mac snow leopard offers an application called the activity monitor which is designed to show you just how hard your cpu hard drives network equipment and memory modules are working behind the scenes.
It is useful if you do not want to install a full fledged ide on the system you are running the heap analysis.
The memory analyzer chart feature is optional.
Simply ensure that the operating system core dump file ends with the dmp suffix for visibility in the mat open heap dump selection.
On a windows machine running a live memory capture is normally fairly easy.
Free download memoryanalyzer memoryanalyzer for mac os x.
The eclipse memory analyzer tool mat.
It also contains more details if you are running on mac os x.
To install the memory analyzer into an eclipse ide use the update site url provided below.
How to run on 64bit vm while the native swt are 32bit.