---

From: Thilaknath Ashokkumar <thilaknath.ashok@gmail.com>
To: vol-users@volatilityfoundation.org
Sent: Friday, November 9, 2012 4:38 PM
Subject: [Vol-users] Guidance

Hi I am currently using volatility to retrieve truecrypt keys stored in memory, by accessing a ram dump. Can you please help me out on how to map the exact location of keys using volatility as i am able to list the process running while the image was taken, and hence forth i am not able to narrow down my search criteria , please help me out.