Re: [Vol-dev] Patch: strings command optimization
7 Sep
2009
7 Sep
'09
5:46 p.m.
Jesse,
I'm still testing your patches,
Cool, thanks for taking a look at it.
but have found the following Perl
script necessary to convert my Mac's strings output into the format
needed by Volatility. I thought others might be able to make use of
it:
[...]
Yeah, I've also been thinking that the strings command should be
changed to accept more standard strings output (i.e. a space as
delimiter). The change would be easy and I don't think it will break
anything, so long as it also accepts ':' as a delimiter. For now
I've just been using something like:
sed 's/ /:/'
to do the conversion myself. (Note that sed will only perform one
replacement per line by default.)
Once it is decided which way this command should be updated (i.e.
changed to a core plugin or something similar), I can come back and
make some more functional changes like this if there's no objections.
cheers,
tim