Re: [Vol-users] unable to extract process 1336 from prolaco-image

Michael, If the process you want to extract is unlinked from the PsActiveProcessHead list, then you can't identify it by pid. Try identifying it by physical offset: $ python vol.py -f ../prolaco.vmem psscan 0x0113f648 1_doc_RCData_61 1336 1136 0x06cc0340 2010-08-11 16:50:20 python vol.py -f ../prolaco.vmem procexedump -o 0x0113f648 -D out/ ************************************************************************ Dumping 1_doc_RCData_61, pid: 1336 output: executable.1336.exe MHL On Mon, Aug 15, 2011 at 5:57 AM, Michael Felber <MichaelFelber(a)gmx.net>wrote: