Hi all,

I'v have a memory dump has an evidence for a case.

Volatility can help me to discover  "Alternate data stream" file on the  system?

Thanks for your help!