Hi Matt,

Welcome to the users list!  Yes there is a way to do that, you can use the `strings` plugin: http://code.google.com/p/volatility/wiki/CommandReference23#strings

Let us know if you have any other questions.

All the best,

-gleeda




On Wed, Nov 13, 2013 at 8:22 AM, Matthew Wong <matthew@coredumps.net> wrote:
Hello All,

I'm new to Volatility.

Say I found the string "password=hello world" somewhere in the memory, is there anyway for me to know which process that memory block is currently allocated to?


--
matt

_______________________________________________
Vol-users mailing list
Vol-users@volatilesystems.com
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users




--
PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3  64C2 196B 2AB5 27A4 AC92