Hi Scott,<div>I&#39;m a Volatility user and normally just use strings and grep to perform a keyword search outside of the tool.</div><div>Not sure about the pmem.ko related question.<br></div><div>Jeremy</div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Tue, Nov 27, 2012 at 2:18 PM, Scott Ehrlich <span dir="ltr">&lt;<a href="mailto:srehrlich@gmail.com" target="_blank">srehrlich@gmail.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
A review of the Linux-capable version of volatility doesn&#39;t seem to<br>
indicate any option of performing a keyword search of captured memory.<br>
<br>
Is this correct?<br>
<br>
Also, I don&#39;t recall seeing an option in pmem.ko for capturing<br>
virtual/shared memory versus physical memory.   Am I missing<br>
something?<br>
<br>
Thanks.<br>
<br>
Scott<br>
_______________________________________________<br>
Vol-users mailing list<br>
<a href="mailto:Vol-users@volatilityfoundation.org">Vol-users@volatilesystems.com</a><br>
<a href="http://lists.volatilityfoundation.org/mailman/listinfo/vol-users" target="_blank">http://lists.volatilityfoundation.org/mailman/listinfo/vol-users</a><br>
<br>
<br>
</blockquote></div><br></div>