Hi guys,
I would like to extract the files which are temporary cached by the
Linux page cache from an Ubuntu memory image.
When I read a file in Linux for the first time, it gets read from the
hard drive but gets also cached.
A second read of the same file then goes faster. Same for writing.
/proc/sys/vm/dirty_expire_centiseconds defines how long data remains in
the page cache until it is written to disk.
First I thought I could use Linux_find_file command of volatility,
however this command is only targeting the tmpfs, right?
Is there another way of extracting files from the Linux page cache?
Thank you!
Sebastian