RE: [Vol-users] Extracting document files from hiberfil.sys
Andy Bellman
18 Apr
2014
18 Apr
'14
5:03 p.m.
Andrew,
Dumpfiles with the -r switch seems to not like *, perhaps it is unneeded. Dumpfiles -r
.txt got me four lines of output, which seem to be the same two files. Dumpfiles saved
them as two VACB files, and when I open them in notepad, I do not see much of anything.
The two files were apparently system files, not anything that I would have had up in
notepad, or notepad plus.
If notepad stored in progress files as .txt in memory, I would have expect to see more, or
parts of more. I have a list of 25 PIDs for notepad processes. The Sysinternals process
explorer, and some other things, seem to imply one process per file or unsaved file.
I've been following Adam Bridge's posts here. I gather that notepad stores its
contents some less intuitive way than a *.txt in memory. I'm guessing maybe in the
dlls and other apparent executables that make up most of what dumpfiles gives me for
notepad.
Thank you,
andybellman(a)outlook.com
Date: Mon, 24 Mar 2014 22:11:04 -0500
From: atcuno(a)gmail.com
To: andybellman(a)outlook.com; vol-users(a)volatilityfoundation.org
Subject: Re: [Vol-users] Extracting document files from hiberfil.sys
If you just want to pull files out then you should try the dumpfiles [1]
plugin. You can filter it with the -r option to say for all *.txt files.
Obviously txt files can be edited with something besides notepad, but
its at least a start.
Also to help filter your vaddump output you could use vadinfo to
determine which file the particular VAD is mapping and then only dump
those of interest.
Thanks,
Andrew (@attrc)
[1] https://code.google.com/p/volatility/wiki/CommandReference23#dumpfiles
On 3/24/2014 6:38 PM, Andy Bellman wrote:
>
> Hello again,
>
>
> So, now that I am using the right profile, the plug ins seem to work.
>
>
> My goal is recovering unsaved notepad files from hibernation. I have a hiberfil.sys
from a Win 7 SP1 64 bit system.
>
>
> My next step seemed to be using pslist to get the PIDs, and putting those into one
of the built in plugins.
>
>
> I've tried dumpfiles, vaddump, memdump, and some others.
>
>
> It looks like I should be able to piece something together between the results of
dumpfiles with a PID switch, and of vaddump with a PID switch. I haven't figured that
out yet. I'm wondering if there is a more specific switch. They both seem to produce
a lot more files than I need.
>
>
> Is there a better way to use volatility's built in tools to pull out files from
notepad?
>
>
> Is there an add on that I can download which will pull out something more quickly
and cleanly?
>
>
> Thanks,
> andybellman(a)outlook.com
>
> _______________________________________________
> Vol-users mailing list
> Vol-users(a)volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
>
Attachments:
- attachment.html (text/html — 3.6 KB)