Hiya John! I'm not sure it comes up with candidates, as I said my knowledge of the 1.3 branch is pretty poor. It looks as though it'll do finding of a DTB in [1]. My guess is that you could alter the code around line 117 to print out any potential matches it found, and then remove the return so that the loop keeps going. It probably won't find you multiple matches that are very close to each other (BLOCKSIZE close, in fact), but it'll get you started... In the 1.4 branch this all happens in [2], but the code is very similar. It's slightly more generic, in that it looks for an EPROCESS structure (which I guess could exist under linux), but still checks to see if the process is called Idle. You can see from the comment there that the value's specific to x86 XP, I dunno whether 2003 will use the same value. Converting this to a generator and allowing people to try out the different possibilities in case there's a system that's sneakily been setup with multiple DTBs could work, but it would need time to sort out... I guess because it looks for an Idle process and then returns based on that, if you had an old Idle process, you'd get the wrong value, but one of the main volatility devs might be able to give you a better explanation. I've only been working on volatility for a few months, and I learnt most of what I know from the source code itself! 5:) You can check it out from subversion at [3], it's pretty much the same as the experimental branch but without the text formatting work-in-progress that Michael Cohen's been implementing in his (rare) free time. 5:) Hehehehehe, no problem, if you don't know the answers they're not stupid questions! 5:) Mike 5:) [1] http://code.google.com/p/volatility/source/browse/tags/Volatility-1.3.1/for… [2] http://code.google.com/p/volatility/source/browse/branches/Volatility-1.4_b… [3] http://volatility.googlecode.com/svn/branches/Volatility-1.4_beta1