Re: [Vol-users] dumping registry hives from memory images

Hi Roger, Ahh yes. It's a known limitation with Windows 7, unfortunately. In the meantime you can use the RegistryAPI [1] to access the registry keys that you would like (or port over a Regripper plugin). Let me know if you need help doing so. All the best, -Jamie [1] http://code.google.com/p/volatility/wiki/CommandReferenceRegistryApi23 On 3/6/14 6:32 PM, Roger wrote: -- Jamie Levy (@gleeda) Blog: http://volatility-labs.blogspot.com/ GPG: http://pgp.mit.edu/pks/lookup?op=get&search=0x196B2AB527A4AC92 Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92