CB Defense: How to Toggle Kernel Debug Logging To Gather A Full Memory Dump

[#1]

Environment

• Microsoft Windows: Windows 8.1 and higher (including Windows 10)
• CB Defense PSC Sensor: 3.5.x.x and higher 

Objective

Toggle kernel debug logging in Windows to gather a full live memory dump (User and Kernel memory space)

Resolution

1. Open a command prompt as Administrator
2. Enter the following command

   bcdedit /debug on

3. Reboot the machine 
4. After gathering a full live memory dump, disable kernel debug logging

   bcdedit /debug off

5. Reboot the machine

Additional Notes

• Kernel debug logging is required in Windows 8.1 and higher to gather live dumps of user memory in addition to kernel memory
• Debugging only needs to be enabled just prior to gathering the memory dump
• Kernel debug logging is not required to gather a full live memory dump from Windows 7-8.0 machines when using RepCLI

Related Content

Setting Up Local Kernel Debugging of a Single Computer Manually - Windows drivers
Carbon Black Cloud: How to Create a Live Memory Dump With RepCLI