Re: [Vol-dev] Patch: strings command optimization

Hi Tim, I'm still testing your patches, but have found the following Perl script necessary to convert my Mac's strings output into the format needed by Volatility. I thought others might be able to make use of it: #!/usr/bin/perl -w while (<>) { $_ =~ s/^(\s*[0-9]+) /$1\:/; print $_; } Usage: $ strings -o [memoryimage] > raw $ ./colon.pl < raw > strings.txt $ python volatility strings -f [memoryimage] -s strings.txt -- Jesse Kornblum