The yarascan plugin is good for this situation.
- Glenn
@hiddenillusion
:: sent from my phone, please excuse any typos ::
Hello All,I'm new to Volatility.Say I found the string "password=hello world" somewhere in the memory, is there anyway for me to know which process that memory block is currently allocated to?--
matt
_______________________________________________
Vol-users mailing list
Vol-users@volatilesystems.com
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users