самое интересное, что это проблема не Windows, это проблема FireWire ... вроде такая же фигня была и с Windows Media Player с дыркой в реализации DRM что ли ...
>I read about Max Dornseif's work on doing memory forensics (and bad things) using the physical-memory-DMA feature of Firewire earlier this year. Being curious, I implemented my own stack of tools to try it out against my Linux laptop (before I knew that Max's OSX python-firewire bindings had been ported to Linux!). It worked just like Max said, and of course, because physical-memory-DMA-busmastering is the Fire in Firewire.