Hi everyone,<span></span><div><br></div>I would like to ask you if it is possible to dump the hive file from a memory image.<div>For some reason the printkey cmd does not return expected values.</div><div>In my virtualbox Windows xp sp3 image contains vboxtray.exe in the RUN key, but I dont see it in the printkey -K &quot;Software\Microsoft\Windows\CurrentVersion\Run&quot; cmd output</div>
<div><br></div><div>I am using volatility version 2.3 beta.</div><div><br></div><div><div>I want to use Windows registry recovery tool to check if it is able to get the info I need.</div></div><div><br></div><div>Thank you</div>
<div><br></div><div>Jaro</div>